feat(calm-server): synchronize cli+calm-server publishing by markscott-ms · Pull Request #2192 · finos/architecture-as-code

markscott-ms · 2026-02-28T17:26:11Z

Description

Also, revert to token auth for publishing until we use Node 24/NPM 11 https://docs.npmjs.com/trusted-publishers

This pull request updates the CI/CD workflows to fully integrate the CALM Server package alongside the CLI, ensuring both are built, tested, versioned, and released together. The changes consolidate the build and release processes, enforce version consistency, and update documentation and automation to reflect the inclusion of CALM Server.

Workflow integration and consolidation:

The build-cli.yml workflow is renamed to Build CLI and CALM Server and now builds, lints, and tests both the CLI and CALM Server modules in parallel. The previously separate build-calm-server.yml workflow is deleted, centralizing all build steps. [1] [2] [3]
The automated release workflow is updated to handle both CLI and CALM Server: version bumps, changelog updates, and release PRs now include both packages, and the workflow is renamed for clarity. [1] [2] [3] [4] [5] [6] [7]

Versioning and release process:

During the release, both cli/package.json and calm-server/package.json are updated to the new version, and both are included in the release commit and PR. The PR title, body, and commit messages are updated to mention both CLI and CALM Server. [1] [2]
The workflow checks that the CLI and CALM Server versions match before proceeding, enforcing version consistency.
On release, separate Git tags and GitHub releases are created for both CLI and CALM Server, and both packages are published to npm. [1] [2]

Package update:

The CALM Server package version is updated from 0.1.0 to 1.34.2 in calm-server/package.json, aligning it with the CLI versioning.

Documentation and messaging:

All user-facing workflow logs, PR titles, and release notes are updated to refer to both CLI and CALM Server, clarifying the joint release process. [1] [2] [3]

These changes ensure that the CLI and CALM Server are always released together with synchronized versions, improving reliability and reducing manual overhead.

Type of Change

🐛 Bug fix (non-breaking change which fixes an issue)
✨ New feature (non-breaking change which adds functionality)
💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
📚 Documentation update
🎨 Code style/formatting changes
♻️ Refactoring (no functional changes)
⚡ Performance improvements
✅ Test additions or updates
🔧 Chore (maintenance, dependencies, CI, etc.)

Affected Components

Commit Message Format ✅

Testing

I have tested my changes locally
I have added/updated unit tests
All existing tests pass

Checklist

My commits follow the conventional commit format
I have updated documentation if necessary
I have added tests for my changes (if applicable)
My changes follow the project's coding standards

Copilot

Pull request overview

Updates CI/CD to release the CALM Server package in lockstep with the CLI, so both are built/tested together and published under the same version.

Changes:

Consolidates CI builds by adding CALM Server build/lint/test to the existing CLI workflow and removing the separate CALM Server workflow.
Extends the automated release workflow to bump versions for both packages, enforce version parity, tag/release both, and publish both to npm.
Aligns calm-server package versioning with the CLI (1.34.2).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
`calm-server/package.json`	Bumps CALM Server version to align with CLI.
`.github/workflows/build-cli.yml`	Adds a CALM Server job to the existing CI workflow.
`.github/workflows/build-calm-server.yml`	Deletes the now-redundant CALM Server CI workflow.
`.github/workflows/automated-release.yml`	Updates release automation to version/tag/release/publish both CLI and CALM Server together.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-28T17:58:18Z

.github/workflows/automated-release.yml

      - name: Create Git tag
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag "cli-v${{ steps.version.outputs.version }}"
          git push origin "cli-v${{ steps.version.outputs.version }}"
+          git tag "calm-server-v${{ steps.version.outputs.version }}"
+          git push origin "calm-server-v${{ steps.version.outputs.version }}"


By introducing an additional calm-server-v* tag, git describe --tags --abbrev=0 in the analyze job may start returning calm-server-vX.Y.Z instead of cli-vX.Y.Z. The current parsing (sed 's/cli-v//' followed by numeric comparisons) will then produce an invalid CURRENT_VERSION and can break the release calculation. Consider restricting git describe to cli-v* via --match, or update the parsing to handle both tag prefixes safely.

Copilot · 2026-02-28T17:58:19Z

.github/workflows/automated-release.yml

          PR_LIST=$(gh pr list \
            --state open \
-            --search "ci(cli): update changelog & versions for v" \
+            --search "ci(cli,calm-server): update changelog & versions for v" \


The workflow searches for existing open release PRs using the title pattern ci(cli,calm-server): update changelog & versions for v, but this workflow creates the PR with the title ci(cli,calm-server): release version .... As written, an existing release PR may not be detected, which can lead to multiple concurrent release PRs and conflicting version bumps. Align the search query with the actual PR title (or switch to searching by label automated-release and/or branch prefix release/cli-v).

Suggested change

--search "ci(cli,calm-server): update changelog & versions for v" \

--search "ci(cli,calm-server): release version" \

Copilot · 2026-02-28T17:58:19Z

.github/workflows/automated-release.yml

+          cd ../calm-server
+          npm publish --provenance --access=public

          echo "✅ Successfully published @finos/calm-cli@${{ steps.version.outputs.version }} to NPM" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Successfully published @finos/calm-server@${{ steps.version.outputs.version }} to NPM" >> $GITHUB_STEP_SUMMARY


This workflow now publishes calm-server to npm, but calm-server/package.json currently depends on @finos/calm-shared via file:../shared, and shared/package.json is marked private: true. Publishing @finos/calm-server with a file: production dependency will make installs fail for consumers (and the dependency cannot be resolved from the registry). Before publishing, ensure the published calm-server package has only registry-resolvable runtime deps (e.g., remove/relocate the file: dependency since tsup bundles it, or publish @finos/calm-shared and depend on a semver range).

Suggested change

cd ../calm-server

npm publish --provenance --access=public

echo "✅ Successfully published @finos/calm-cli@${{ steps.version.outputs.version }} to NPM" >> $GITHUB_STEP_SUMMARY

echo "✅ Successfully published @finos/calm-server@${{ steps.version.outputs.version }} to NPM" >> $GITHUB_STEP_SUMMARY

echo "✅ Successfully published @finos/calm-cli@${{ steps.version.outputs.version }} to NPM" >> $GITHUB_STEP_SUMMARY

Copilot · 2026-02-28T17:58:19Z

calm-server/package.json

 {
    "name": "@finos/calm-server",
-    "version": "0.1.0",
+    "version": "1.34.2",


calm-server/package.json is bumped to 1.34.2, but the root package-lock.json still records the calm-server workspace as version 0.1.0. With npm ci in CI, this version skew is likely to fail installs due to an out-of-sync lockfile. Regenerate/update package-lock.json (from the repo root) so the lockfile reflects the new calm-server version.

Suggested change

"version": "1.34.2",

"version": "0.1.0",

Copilot · 2026-02-28T17:58:19Z

.github/workflows/automated-release.yml

            git config user.email "github-actions[bot]@users.noreply.github.com"
-            git add CHANGELOG.md package.json
-            git commit -m "ci(cli): release version ${{ needs.analyze.outputs.next-version }}"
+            git add CHANGELOG.md package.json ../calm-server/package.json


The workflow runs npm version in workspaces, which typically updates the root package-lock.json as well. However, the commit only stages CHANGELOG.md, cli/package.json, and calm-server/package.json. This can leave the lockfile out of sync (and cause npm ci failures on the release PR). Stage/commit the updated package-lock.json too (or explicitly disable lockfile updates if that’s the intended behavior).

Suggested change

git add CHANGELOG.md package.json ../calm-server/package.json

git add CHANGELOG.md package.json ../calm-server/package.json

# Ensure any updated lockfiles are included in the release commit

if [ -f "../package-lock.json" ]; then

git add ../package-lock.json

fi

if [ -f "package-lock.json" ]; then

git add package-lock.json

fi

if [ -f "../calm-server/package-lock.json" ]; then

git add ../calm-server/package-lock.json

fi

Copilot · 2026-02-28T17:58:20Z

.github/workflows/automated-release.yml

            git config user.email "github-actions[bot]@users.noreply.github.com"
-            git add CHANGELOG.md package.json
-            git commit -m "ci(cli): release version $NEXT_VERSION"
+            git add CHANGELOG.md package.json ../calm-server/package.json


Same issue in the non-forced path: after running npm version in both cli and calm-server, the workflow commits only the package.json files + CHANGELOG. If package-lock.json is modified, it won’t be included in the release PR, potentially breaking npm ci. Stage/commit package-lock.json here as well (or ensure it is not modified).

Suggested change

git add CHANGELOG.md package.json ../calm-server/package.json

git add CHANGELOG.md package.json package-lock.json ../calm-server/package.json ../calm-server/package-lock.json

markscott-ms requested a review from a team as a code owner February 28, 2026 17:26

github-actions bot added the config label Feb 28, 2026

markscott-ms requested a review from Copilot February 28, 2026 17:53

Copilot started reviewing on behalf of markscott-ms February 28, 2026 17:54 View session

Copilot AI reviewed Feb 28, 2026

View reviewed changes

markscott-ms marked this pull request as draft February 28, 2026 18:07

markscott-ms force-pushed the issues/2051-calm-server branch from 77fb1d6 to fbc27bb Compare February 28, 2026 18:09

markscott-ms closed this Feb 28, 2026

markscott-ms force-pushed the issues/2051-calm-server branch from fbc27bb to a284ee0 Compare February 28, 2026 18:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(calm-server): synchronize cli+calm-server publishing#2192

feat(calm-server): synchronize cli+calm-server publishing#2192
markscott-ms wants to merge 0 commit intofinos:mainfrom
markscott-ms:issues/2051-calm-server

markscott-ms commented Feb 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 28, 2026

Uh oh!

Copilot AI Feb 28, 2026

Uh oh!

Copilot AI Feb 28, 2026

Uh oh!

Copilot AI Feb 28, 2026

Uh oh!

Copilot AI Feb 28, 2026

Uh oh!

Copilot AI Feb 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	--search "ci(cli,calm-server): update changelog & versions for v" \
	--search "ci(cli,calm-server): release version" \

-            git add CHANGELOG.md package.json ../calm-server/package.json
+            git add CHANGELOG.md package.json ../calm-server/package.json
+            # Ensure any updated lockfiles are included in the release commit
+            if [ -f "../package-lock.json" ]; then
+              git add ../package-lock.json
+            fi
+            if [ -f "package-lock.json" ]; then
+              git add package-lock.json
+            fi
+            if [ -f "../calm-server/package-lock.json" ]; then
+              git add ../calm-server/package-lock.json
+            fi

	git add CHANGELOG.md package.json ../calm-server/package.json
	git add CHANGELOG.md package.json package-lock.json ../calm-server/package.json ../calm-server/package-lock.json

Conversation

markscott-ms commented Feb 28, 2026

Description

Type of Change

Affected Components

Commit Message Format ✅

Testing

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants