Release #92
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Release runs only after the CI workflow has completed successfully on a push | |
| # to `main`. This gates npm publish behind green lint/typecheck/test/build | |
| # (STRUCT-073) and lets us publish the exact artifact CI validated (STRUCT-081). | |
| on: | |
| workflow_run: | |
| workflows: [CI] | |
| types: [completed] | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch }} | |
| cancel-in-progress: true | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| # Only release for a successful CI run triggered by a push to main. | |
| if: >- | |
| github.event.workflow_run.conclusion == 'success' && | |
| github.event.workflow_run.event == 'push' && | |
| github.event.workflow_run.head_branch == 'main' | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| id-token: write | |
| # Cross-run artifact download (actions/download-artifact with run-id + | |
| # github-token) needs actions:read. Once a permissions block is declared, | |
| # every unlisted scope defaults to none, so this must be explicit or the | |
| # "Download validated build artifact" step 403s. (CR-001 / STRUCT-081) | |
| actions: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.workflow_run.head_sha }} | |
| # Full history (all branches) so `pnpm changeset status` can diff | |
| # against the `main` baseBranch when generating the PR body; a shallow | |
| # detached checkout errors and silently degrades the body. (CR-007 / STRUCT-076) | |
| fetch-depth: 0 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| registry-url: https://registry.npmjs.org | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| # Publish the exact build CI produced and validated instead of rebuilding. | |
| - name: Download validated build artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: datum-ui-dist | |
| path: packages/datum-ui/dist/ | |
| run-id: ${{ github.event.workflow_run.id }} | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Generate PR description | |
| id: pr-body | |
| run: | | |
| BODY=$(.github/scripts/generate-version-pr-body.sh) | |
| { | |
| echo "body<<EOF" | |
| echo "$BODY" | |
| echo "EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| # Determine title suffix based on bump type | |
| if grep -q "Release Type: \`major\`" <<< "$BODY"; then | |
| echo "title-suffix=(major)" >> "$GITHUB_OUTPUT" | |
| elif grep -q "Release Type: \`minor\`" <<< "$BODY"; then | |
| echo "title-suffix=(minor)" >> "$GITHUB_OUTPUT" | |
| elif grep -q "Release Type: \`patch\`" <<< "$BODY"; then | |
| echo "title-suffix=(patch)" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "title-suffix=" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Create Release Pull Request or Publish | |
| id: changesets | |
| uses: changesets/action@v1 | |
| with: | |
| version: pnpm changeset version | |
| publish: pnpm changeset publish | |
| commit: "chore: version packages" | |
| title: "chore: version packages ${{ steps.pr-body.outputs.title-suffix }}" | |
| createGithubReleases: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| # Pass the body through the environment (never interpolated into the shell | |
| # command) so backticks/quotes in the changelog can't be executed. (BUG-107) | |
| - name: Update PR description | |
| if: steps.changesets.outputs.pullRequestNumber != '' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_BODY: ${{ steps.pr-body.outputs.body }} | |
| PR_NUMBER: ${{ steps.changesets.outputs.pullRequestNumber }} | |
| run: | | |
| gh pr edit "$PR_NUMBER" --body "$PR_BODY" |