ci: automate releases

Publishing this app is manual today, and the repo drifted from what Zapier
runs: #99 had to reconstruct 4.10.0 through 4.14.0 out of the published app
and back into git.

A bot now opens one release PR when code that reaches Zapier changed since
the last release, and merging it uploads the version and promotes it. It
reads the last release from the last commit that changed the version field
rather than a tag, because tagging stopped here in 2021 and the version
field is what Zapier keys on. Existing Zaps keep the version they were built
on, because nothing migrates them.

The repo moves to Node 22, because the pinned Zapier CLI pulls dependencies
that refuse to install below Node 20. Zapier still runs this app on Node 18,
and will until we move to core 17.

Check the promote step. It passes --yes, without which the CLI waits on a
prompt nobody can answer on a runner, and that flag also accepts Zapier's
non-blocking pre-check warnings.

Towards INF-3414

Author: eliias

.github/workflows/nodejs.yml

@@ -8,12 +8,14 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [18.19.1]
+        node-version: [22.23.2]
 
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: yarn, build, and test
@@ -25,3 +27,7 @@ jobs:
           NODE_ENV: test
           LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
           LINEAR_TEAM_ID: ${{ secrets.LINEAR_TEAM_ID }}
+      - name: Validate the Zapier schema
+        run: |
+          yarn zapier-build
+          ./node_modules/.bin/zapier-platform validate --without-style

.github/workflows/release-pr.yml

@@ -0,0 +1,92 @@
+name: Release PR
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: release-pr
+  cancel-in-progress: false
+
+jobs:
+  release-pr:
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_branch == 'master'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+
+      - name: Look for changes that never shipped
+        id: detect
+        run: |
+          last=$(git log -1 --format=%H -G'"version":' -- package.json)
+          if [ -z "$last" ]; then
+            echo "no commit found that changed the version field" >&2
+            exit 1
+          fi
+          echo "last release commit: $last"
+
+          changed=$(git diff --name-only "$last..HEAD" -- src index.js tsconfig.json ':(exclude)src/test')
+          git show "$last:package.json" > "$RUNNER_TEMP/old-package.json"
+          deps=$(node scripts/dependencies-changed.js "$RUNNER_TEMP/old-package.json" package.json)
+
+          if [ -z "$changed" ] && [ "$deps" = "false" ]; then
+            echo "nothing to release"
+            echo "release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "changed files:"
+          echo "$changed"
+          echo "dependencies changed: $deps"
+          echo "release=true" >> "$GITHUB_OUTPUT"
+          git log --first-parent --format=%s "$last..HEAD" > "$RUNNER_TEMP/titles.txt"
+
+      - name: Prepare the bump
+        if: steps.detect.outputs.release == 'true'
+        id: prepare
+        run: |
+          mapfile -t titles < "$RUNNER_TEMP/titles.txt"
+          version=$(node scripts/prepare-release.js "${titles[@]}")
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Open or update the release PR
+        if: steps.detect.outputs.release == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.prepare.outputs.version }}
+        run: |
+          if git ls-remote --exit-code --heads origin release/next >/dev/null 2>&1; then
+            git fetch origin release/next
+            author=$(git log -1 --format=%an FETCH_HEAD)
+            if [ "$author" != "github-actions[bot]" ]; then
+              echo "release/next carries a commit by $author, leaving it alone"
+              exit 0
+            fi
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B release/next
+          git commit -m "chore: release $VERSION" package.json CHANGELOG.md
+          git push --force "https://x-access-token:$GH_TOKEN@github.com/$GITHUB_REPOSITORY" release/next
+
+          if [ -z "$(gh pr list --head release/next --state open --json number --jq '.[].number')" ]; then
+            gh pr create --base master --head release/next \
+              --title "Release $VERSION" \
+              --body "Merging this uploads $VERSION to Zapier and promotes it. Edit the changelog entry if the generated one reads badly. Once you commit to this branch the bot leaves it alone, so it will stop adding later changes from master."
+          fi

.github/workflows/release.yml

@@ -0,0 +1,96 @@
+name: Release
+
+on:
+  push:
+    branches: [master]
+    paths: ["package.json"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Look for a version change
+        id: detect
+        env:
+          BEFORE: ${{ github.event.before }}
+        run: |
+          if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
+            echo "no previous commit to compare against"
+            echo "release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          current=$(node -p "require('./package.json').version")
+          if ! printf '%s' "$current" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "unexpected version format: $current" >&2
+            exit 1
+          fi
+          previous=$(git show "$BEFORE:package.json" | node -p "JSON.parse(require('fs').readFileSync(0, 'utf8')).version")
+          if [ "$current" = "$previous" ]; then
+            echo "version unchanged, nothing to do"
+            echo "release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "releasing $previous -> $current"
+          echo "release=true" >> "$GITHUB_OUTPUT"
+          echo "version=$current" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        if: steps.detect.outputs.release == 'true'
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+
+      - name: Install
+        if: steps.detect.outputs.release == 'true'
+        run: yarn install --frozen-lockfile
+
+      - name: Test
+        if: steps.detect.outputs.release == 'true'
+        run: yarn test
+        env:
+          CI: true
+          NODE_ENV: test
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+          LINEAR_TEAM_ID: ${{ secrets.LINEAR_TEAM_ID }}
+
+      - name: Build, validate and upload
+        if: steps.detect.outputs.release == 'true'
+        run: yarn zapier-push
+        env:
+          ZAPIER_DEPLOY_KEY: ${{ secrets.ZAPIER_DEPLOY_KEY }}
+
+      - name: Promote
+        if: steps.detect.outputs.release == 'true'
+        env:
+          ZAPIER_DEPLOY_KEY: ${{ secrets.ZAPIER_DEPLOY_KEY }}
+          VERSION: ${{ steps.detect.outputs.version }}
+        run: |
+          ./node_modules/.bin/zapier-platform promote --yes "$VERSION"
+
+          for attempt in $(seq 1 60); do
+            stage=$(./node_modules/.bin/zapier-platform jobs --format=raw 2>/dev/null \
+              | jq -r --arg v "$VERSION" '[.[] | select(.job_kind == "promote" and .version_to == $v)] | last | .job_stage' 2>/dev/null || true)
+            echo "attempt $attempt: ${stage:-no job yet}"
+            case "$stage" in
+              complete) exit 0 ;;
+              errored|aborted|paused) echo "promotion ended as $stage" >&2; exit 1 ;;
+            esac
+            sleep 20
+          done
+
+          echo "promotion did not finish within 20 minutes" >&2
+          exit 1

.nvmrc

@@ -1 +1 @@
-18.19.1
+22.23.2

README.md

@@ -22,14 +22,19 @@ For testing, save your envvars to `.env`. `.env.default` has the required variab
 
 ### Deployment
 
-Prerequisites:
+Releases are automatic. A bot opens a release PR whenever code that ships has changed since the
+last release. Merging that PR uploads the version to Zapier and promotes it, so new Zaps get it.
 
-- Make sure you have updated the version number in `package.json`.
-- If updating Linear's app, you'll need to have access to Linear's Zapier account and generate a deploy key in `Settings > Deploy Keys`. You can then authenticate with the key using `zapier login --sso`.
+Two things the release does not do. It does not move existing Zaps to the new version, so they
+keep running the version they were built on. It does not deprecate old versions.
 
-You can deploy the app to Zapier with `yarn zapier-push`. This will also run `yarn zapier-validate` before deploying.
+Edit the changelog entry in the release PR if the generated one reads badly. The bot fills it from
+pull request titles, which is a starting point. Once you commit to that branch the bot leaves it
+alone, so it stops adding later changes from master.
 
-After deploying, you'll need to manually promote the version to 'public' in Zapier's dashboard under `App > Manage > Versions`.
+If a release run fails, fix the cause and re-run it from the Actions tab. It repeats the whole
+release. If the upload already succeeded and only the promotion failed, promote that version from
+the Zapier dashboard instead, because Zapier rejects a second upload of a version it already has.
 
 ## Forking
 

package.json

@@ -11,11 +11,11 @@
     "zapier-push": "npm run zapier-validate && zapier-platform push",
     "prepare": "npm run zapier-build && (husky install || true)",
     "pretest": "npm run zapier-build",
-    "test": "jest --passWithNoTests src/test",
+    "test": "jest --passWithNoTests src/test scripts",
     "prettier": "npx prettier --write ."
   },
   "engines": {
-    "node": ">=18.0.0",
+    "node": ">=22.0.0",
     "npm": ">=10.0.0"
   },
   "dependencies": {
@@ -31,7 +31,8 @@
     "jest": "^29.7.0",
     "lint-staged": ">=10",
     "prettier": "^3.3.3",
-    "typescript": "^5.3.3"
+    "typescript": "^5.3.3",
+    "zapier-platform-cli": "19.1.0"
   },
   "lint-staged": {
     "*.{js,ts,json}": "prettier --write"

scripts/dependencies-changed.js

@@ -0,0 +1,20 @@
+const fs = require("fs");
+
+const canonical = (dependencies = {}) =>
+  JSON.stringify(
+    Object.keys(dependencies)
+      .sort()
+      .map((name) => [name, dependencies[name]])
+  );
+
+const dependenciesChanged = (oldManifest, newManifest) =>
+  canonical(oldManifest.dependencies) !== canonical(newManifest.dependencies);
+
+const read = (file) => JSON.parse(fs.readFileSync(file, "utf8"));
+
+module.exports = { dependenciesChanged };
+
+if (require.main === module) {
+  const [oldFile, newFile] = process.argv.slice(2);
+  process.stdout.write(String(dependenciesChanged(read(oldFile), read(newFile))));
+}

scripts/dependencies-changed.test.js

@@ -0,0 +1,35 @@
+const { dependenciesChanged } = require("./dependencies-changed");
+
+const manifest = (dependencies) => ({ name: "linear-zapier", version: "4.15.0", dependencies });
+
+describe("dependenciesChanged", () => {
+  it("sees a version change", () => {
+    expect(dependenciesChanged(manifest({ lodash: "4.17.21" }), manifest({ lodash: "4.17.22" }))).toBe(true);
+  });
+
+  it("sees an added and a removed dependency", () => {
+    expect(dependenciesChanged(manifest({ lodash: "4.17.21" }), manifest({ lodash: "4.17.21", ky: "1.0.0" }))).toBe(
+      true
+    );
+    expect(dependenciesChanged(manifest({ lodash: "4.17.21", ky: "1.0.0" }), manifest({ lodash: "4.17.21" }))).toBe(
+      true
+    );
+  });
+
+  it("ignores key order", () => {
+    expect(
+      dependenciesChanged(manifest({ lodash: "4.17.21", ky: "1.0.0" }), manifest({ ky: "1.0.0", lodash: "4.17.21" }))
+    ).toBe(false);
+  });
+
+  it("ignores everything outside the dependencies block", () => {
+    const before = { ...manifest({ lodash: "4.17.21" }), devDependencies: { jest: "29.7.0" }, scripts: { test: "a" } };
+    const after = { ...manifest({ lodash: "4.17.21" }), devDependencies: { jest: "30.0.0" }, scripts: { test: "b" } };
+    expect(dependenciesChanged(before, after)).toBe(false);
+  });
+
+  it("treats a missing dependencies block as empty", () => {
+    expect(dependenciesChanged({ name: "x" }, { name: "x" })).toBe(false);
+    expect(dependenciesChanged({ name: "x" }, manifest({ lodash: "4.17.21" }))).toBe(true);
+  });
+});

scripts/prepare-release.js

@@ -0,0 +1,42 @@
+const fs = require("fs");
+const path = require("path");
+
+const ROOT = path.join(__dirname, "..");
+const PACKAGE_FILE = path.join(ROOT, "package.json");
+const CHANGELOG_FILE = path.join(ROOT, "CHANGELOG.md");
+
+const nextMinor = (version) => {
+  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+  if (!parts) {
+    throw new Error(`Unsupported version: ${version}`);
+  }
+  return `${parts[1]}.${Number(parts[2]) + 1}.0`;
+};
+
+const stripPullRequestReference = (title) => title.replace(/\s*\(#\d+\)|\s+#\d+\b/g, "").trim();
+
+const changelogEntry = (version, titles) => {
+  const bullets = titles.length > 0 ? titles.map(stripPullRequestReference) : ["No description."];
+  return `## ${version}\n\n${bullets.map((title) => `- ${title}`).join("\n")}\n`;
+};
+
+const prependEntry = (changelog, entry) => `${entry}\n${changelog}`;
+
+const main = (titles) => {
+  const manifest = JSON.parse(fs.readFileSync(PACKAGE_FILE, "utf8"));
+  const version = nextMinor(manifest.version);
+
+  manifest.version = version;
+  fs.writeFileSync(PACKAGE_FILE, `${JSON.stringify(manifest, null, 2)}\n`);
+
+  const changelog = fs.readFileSync(CHANGELOG_FILE, "utf8");
+  fs.writeFileSync(CHANGELOG_FILE, prependEntry(changelog, changelogEntry(version, titles)));
+
+  process.stdout.write(version);
+};
+
+module.exports = { nextMinor, changelogEntry, prependEntry };
+
+if (require.main === module) {
+  main(process.argv.slice(2));
+}