ci: automate releases

Publishing this app is manual today, and the repo drifted from what Zapier
runs: #99 had to reconstruct 4.10.0 through 4.14.0 out of the published app
and back into git.

A bot now opens one release PR when code that reaches Zapier changed since
the last release, and merging it uploads the version and promotes it. It
reads the last release from the last commit that changed the version field
rather than a tag, because tagging stopped here in 2021 and the version
field is what Zapier keys on. Existing Zaps keep the version they were built
on, because nothing migrates them.

A scheduled check compares the version in git with what Zapier holds, because
the bot reads what shipped out of the version field, and that records intent
rather than outcome.

The repo moves to Node 22, because the pinned Zapier CLI pulls dependencies
that refuse to install below Node 20. Zapier still runs this app on Node 18,
and will until we move to core 17.

Check the promote step. It passes --yes, without which the CLI waits on a
prompt nobody can answer on a runner, and that flag also accepts Zapier's
non-blocking pre-check warnings.

Towards INF-3414

Author: eliias

.github/workflows/nodejs.yml

@@ -8,12 +8,14 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [18.19.1]
+        node-version: [22.23.2]
 
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: yarn, build, and test
@@ -25,3 +27,7 @@ jobs:
           NODE_ENV: test
           LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
           LINEAR_TEAM_ID: ${{ secrets.LINEAR_TEAM_ID }}
+      - name: Validate the Zapier schema
+        run: |
+          yarn zapier-build
+          ./node_modules/.bin/zapier-platform validate --without-style

.github/workflows/release-drift.yml

@@ -0,0 +1,35 @@
+name: Release drift
+
+on:
+  schedule:
+    - cron: "0 9 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  drift:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+
+      - name: Install
+        run: yarn install --frozen-lockfile
+
+      - name: Compare git with Zapier
+        env:
+          ZAPIER_DEPLOY_KEY: ${{ secrets.ZAPIER_DEPLOY_KEY }}
+        run: |
+          ./node_modules/.bin/zapier-platform versions --format=raw > "$RUNNER_TEMP/versions.json"
+          ./node_modules/.bin/zapier-platform jobs --format=raw > "$RUNNER_TEMP/jobs.json"
+          jq -e . "$RUNNER_TEMP/jobs.json" >/dev/null 2>&1 || echo "[]" > "$RUNNER_TEMP/jobs.json"
+          node scripts/check-release-drift.js "$RUNNER_TEMP/versions.json" "$RUNNER_TEMP/jobs.json"

.github/workflows/release-pr.yml

@@ -0,0 +1,92 @@
+name: Release PR
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: release-pr
+  cancel-in-progress: false
+
+jobs:
+  release-pr:
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_branch == 'master'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+
+      - name: Look for changes that never shipped
+        id: detect
+        run: |
+          last=$(git log -1 --format=%H -G'"version":' -- package.json)
+          if [ -z "$last" ]; then
+            echo "no commit found that changed the version field" >&2
+            exit 1
+          fi
+          echo "last release commit: $last"
+
+          changed=$(git diff --name-only "$last..HEAD" -- src index.js tsconfig.json ':(exclude)src/test')
+          git show "$last:package.json" > "$RUNNER_TEMP/old-package.json"
+          deps=$(node scripts/dependencies-changed.js "$RUNNER_TEMP/old-package.json" package.json)
+
+          if [ -z "$changed" ] && [ "$deps" = "false" ]; then
+            echo "nothing to release"
+            echo "release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "changed files:"
+          echo "$changed"
+          echo "dependencies changed: $deps"
+          echo "release=true" >> "$GITHUB_OUTPUT"
+          git log --first-parent --format=%s "$last..HEAD" > "$RUNNER_TEMP/titles.txt"
+
+      - name: Prepare the bump
+        if: steps.detect.outputs.release == 'true'
+        id: prepare
+        run: |
+          mapfile -t titles < "$RUNNER_TEMP/titles.txt"
+          version=$(node scripts/prepare-release.js "${titles[@]}")
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Open or update the release PR
+        if: steps.detect.outputs.release == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.prepare.outputs.version }}
+        run: |
+          if git ls-remote --exit-code --heads origin release/next >/dev/null 2>&1; then
+            git fetch origin release/next
+            author=$(git log -1 --format=%an FETCH_HEAD)
+            if [ "$author" != "github-actions[bot]" ]; then
+              echo "release/next carries a commit by $author, leaving it alone"
+              exit 0
+            fi
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B release/next
+          git commit -m "chore: release $VERSION" package.json CHANGELOG.md
+          git push --force "https://x-access-token:$GH_TOKEN@github.com/$GITHUB_REPOSITORY" release/next
+
+          if [ -z "$(gh pr list --head release/next --state open --json number --jq '.[].number')" ]; then
+            gh pr create --base master --head release/next \
+              --title "Release $VERSION" \
+              --body "Merging this uploads $VERSION to Zapier and promotes it. Edit the changelog entry if the generated one reads badly. Once you commit to this branch the bot leaves it alone, so it will stop adding later changes from master."
+          fi

.github/workflows/release.yml

@@ -0,0 +1,96 @@
+name: Release
+
+on:
+  push:
+    branches: [master]
+    paths: ["package.json"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Look for a version change
+        id: detect
+        env:
+          BEFORE: ${{ github.event.before }}
+        run: |
+          if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
+            echo "no previous commit to compare against"
+            echo "release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          current=$(node -p "require('./package.json').version")
+          if ! printf '%s' "$current" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "unexpected version format: $current" >&2
+            exit 1
+          fi
+          previous=$(git show "$BEFORE:package.json" | node -p "JSON.parse(require('fs').readFileSync(0, 'utf8')).version")
+          if [ "$current" = "$previous" ]; then
+            echo "version unchanged, nothing to do"
+            echo "release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "releasing $previous -> $current"
+          echo "release=true" >> "$GITHUB_OUTPUT"
+          echo "version=$current" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        if: steps.detect.outputs.release == 'true'
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+
+      - name: Install
+        if: steps.detect.outputs.release == 'true'
+        run: yarn install --frozen-lockfile
+
+      - name: Test
+        if: steps.detect.outputs.release == 'true'
+        run: yarn test
+        env:
+          CI: true
+          NODE_ENV: test
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+          LINEAR_TEAM_ID: ${{ secrets.LINEAR_TEAM_ID }}
+
+      - name: Build, validate and upload
+        if: steps.detect.outputs.release == 'true'
+        run: yarn zapier-push
+        env:
+          ZAPIER_DEPLOY_KEY: ${{ secrets.ZAPIER_DEPLOY_KEY }}
+
+      - name: Promote
+        if: steps.detect.outputs.release == 'true'
+        env:
+          ZAPIER_DEPLOY_KEY: ${{ secrets.ZAPIER_DEPLOY_KEY }}
+          VERSION: ${{ steps.detect.outputs.version }}
+        run: |
+          ./node_modules/.bin/zapier-platform promote --yes "$VERSION"
+
+          for attempt in $(seq 1 60); do
+            stage=$(./node_modules/.bin/zapier-platform jobs --format=raw 2>/dev/null \
+              | jq -r --arg v "$VERSION" '[.[] | select(.job_kind == "promote" and .version_to == $v)] | last | .job_stage' 2>/dev/null || true)
+            echo "attempt $attempt: ${stage:-no job yet}"
+            case "$stage" in
+              complete) exit 0 ;;
+              errored|aborted|paused) echo "promotion ended as $stage" >&2; exit 1 ;;
+            esac
+            sleep 20
+          done
+
+          echo "promotion did not finish within 20 minutes" >&2
+          exit 1

.nvmrc

@@ -1 +1 @@
-18.19.1
+22.23.2

README.md

@@ -22,14 +22,22 @@ For testing, save your envvars to `.env`. `.env.default` has the required variab
 
 ### Deployment
 
-Prerequisites:
+Releases are automatic. A bot opens a release PR whenever code that ships has changed since the
+last release. Merging that PR uploads the version to Zapier and promotes it, so new Zaps get it.
 
-- Make sure you have updated the version number in `package.json`.
-- If updating Linear's app, you'll need to have access to Linear's Zapier account and generate a deploy key in `Settings > Deploy Keys`. You can then authenticate with the key using `zapier login --sso`.
+Two things the release does not do. It does not move existing Zaps to the new version, so they
+keep running the version they were built on. It does not deprecate old versions.
 
-You can deploy the app to Zapier with `yarn zapier-push`. This will also run `yarn zapier-validate` before deploying.
+Edit the changelog entry in the release PR if the generated one reads badly. The bot fills it from
+pull request titles, which is a starting point. Once you commit to that branch the bot leaves it
+alone, so it stops adding later changes from master.
 
-After deploying, you'll need to manually promote the version to 'public' in Zapier's dashboard under `App > Manage > Versions`.
+If a release run fails, fix the cause and re-run it from the Actions tab. It repeats the whole
+release. If the upload already succeeded and only the promotion failed, promote that version from
+the Zapier dashboard instead, because Zapier rejects a second upload of a version it already has.
+
+A scheduled check compares the version in `package.json` with what Zapier holds, and fails if the
+version in git never reached Zapier. Run it from the Actions tab when you want an answer sooner.
 
 ## Forking
 

package.json

@@ -11,11 +11,11 @@
     "zapier-push": "npm run zapier-validate && zapier-platform push",
     "prepare": "npm run zapier-build && (husky install || true)",
     "pretest": "npm run zapier-build",
-    "test": "jest --passWithNoTests src/test",
+    "test": "jest --passWithNoTests src/test scripts",
     "prettier": "npx prettier --write ."
   },
   "engines": {
-    "node": ">=18.0.0",
+    "node": ">=22.0.0",
     "npm": ">=10.0.0"
   },
   "dependencies": {
@@ -31,7 +31,8 @@
     "jest": "^29.7.0",
     "lint-staged": ">=10",
     "prettier": "^3.3.3",
-    "typescript": "^5.3.3"
+    "typescript": "^5.3.3",
+    "zapier-platform-cli": "19.1.0"
   },
   "lint-staged": {
     "*.{js,ts,json}": "prettier --write"

scripts/check-release-drift.js

@@ -0,0 +1,43 @@
+const fs = require("fs");
+const path = require("path");
+
+const ROOT = path.join(__dirname, "..");
+const PACKAGE_FILE = path.join(ROOT, "package.json");
+const END_STAGES = ["aborted", "errored", "paused"];
+
+const driftReason = (version, versions, jobs) => {
+  const row = versions.find((v) => v.version === version);
+  if (!row) {
+    return `${version} is in git but was never uploaded to Zapier.`;
+  }
+  if (row.state === "deprecated") {
+    return `${version} is deprecated on Zapier.`;
+  }
+
+  const promotions = jobs.filter((job) => job.job_kind === "promote" && job.version_to === version);
+  const completed = promotions.some((job) => job.job_stage === "complete");
+  const failed = promotions.find((job) => END_STAGES.includes(job.job_stage));
+  if (failed && !completed) {
+    return `${version} promotion ended as ${failed.job_stage}.`;
+  }
+
+  return null;
+};
+
+const read = (file) => JSON.parse(fs.readFileSync(file, "utf8"));
+
+module.exports = { driftReason };
+
+if (require.main === module) {
+  const [versionsFile, jobsFile] = process.argv.slice(2);
+  const manifest = read(PACKAGE_FILE);
+  const versions = read(versionsFile);
+  const jobs = read(jobsFile);
+
+  const reason = driftReason(manifest.version, versions, jobs);
+  if (reason) {
+    process.stdout.write(`${reason}\n`);
+    process.exit(1);
+  }
+  process.stdout.write(`${manifest.version} matches what Zapier holds.\n`);
+}

scripts/check-release-drift.test.js

@@ -0,0 +1,28 @@
+const { driftReason } = require("./check-release-drift");
+
+describe("driftReason", () => {
+  it("sees no drift when the version shipped and no jobs exist", () => {
+    expect(driftReason("4.16.0", [{ version: "4.16.0", state: "live" }], [])).toBe(null);
+  });
+
+  it("flags a version missing from Zapier", () => {
+    expect(driftReason("4.16.0", [{ version: "4.15.0", state: "live" }], [])).toMatch(/never uploaded/);
+  });
+
+  it("flags a deprecated version", () => {
+    expect(driftReason("4.16.0", [{ version: "4.16.0", state: "deprecated" }], [])).toMatch(/deprecated/);
+  });
+
+  it("flags a version whose only promotion errored", () => {
+    const jobs = [{ job_kind: "promote", version_to: "4.16.0", job_stage: "errored" }];
+    expect(driftReason("4.16.0", [{ version: "4.16.0", state: "live" }], jobs)).toMatch(/errored/);
+  });
+
+  it("sees no drift when a later promotion completed", () => {
+    const jobs = [
+      { job_kind: "promote", version_to: "4.16.0", job_stage: "errored" },
+      { job_kind: "promote", version_to: "4.16.0", job_stage: "complete" },
+    ];
+    expect(driftReason("4.16.0", [{ version: "4.16.0", state: "live" }], jobs)).toBe(null);
+  });
+});