ci: automate releases

Publishing this app is manual today, and the repo drifted from what Zapier
runs: #99 had to reconstruct 4.10.0 through 4.14.0 out of the published app
and back into git.

A bot now opens one release PR when code that reaches Zapier changed since
the last release, and merging it uploads the version and promotes it. It
reads the last release from the last commit that changed the version field
rather than a tag, because tagging stopped here in 2021 and the version
field is what Zapier keys on. Existing Zaps keep the version they were built
on, because nothing migrates them.

The repo moves to Node 22, because the pinned Zapier CLI pulls dependencies
that refuse to install below Node 20. Zapier still runs this app on Node 18,
and will until we move to core 17.

Check the promote step. It passes --yes, without which the CLI waits on a
prompt nobody can answer on a runner, and that flag also accepts Zapier's
non-blocking pre-check warnings.

Towards INF-3414

Author: eliias

.github/workflows/nodejs.yml

@@ -8,12 +8,14 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [18.19.1]
+        node-version: [22.23.2]
 
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: yarn, build, and test

.github/workflows/release-pr.yml

@@ -0,0 +1,86 @@
+name: Release PR
+
+on:
+  push:
+    branches: [master]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: release-pr
+  cancel-in-progress: false
+
+jobs:
+  release-pr:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+
+      - name: Look for changes that never shipped
+        id: detect
+        run: |
+          last=$(git log -1 --format=%H -G'"version":' -- package.json)
+          echo "last release commit: $last"
+
+          changed=$(git diff --name-only "$last..HEAD" -- src index.js tsconfig.json ':(exclude)src/test')
+          git show "$last:package.json" > "$RUNNER_TEMP/old-package.json"
+          deps=$(node scripts/dependencies-changed.js "$RUNNER_TEMP/old-package.json" package.json)
+
+          if [ -z "$changed" ] && [ "$deps" = "false" ]; then
+            echo "nothing to release"
+            echo "release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "changed files:"
+          echo "$changed"
+          echo "dependencies changed: $deps"
+          echo "release=true" >> "$GITHUB_OUTPUT"
+          git log --first-parent --format=%s "$last..HEAD" > "$RUNNER_TEMP/titles.txt"
+
+      - name: Test before proposing a release
+        if: steps.detect.outputs.release == 'true'
+        run: |
+          yarn install --frozen-lockfile
+          yarn test
+        env:
+          CI: true
+          NODE_ENV: test
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+          LINEAR_TEAM_ID: ${{ secrets.LINEAR_TEAM_ID }}
+
+      - name: Prepare the bump
+        if: steps.detect.outputs.release == 'true'
+        id: prepare
+        run: |
+          mapfile -t titles < "$RUNNER_TEMP/titles.txt"
+          version=$(node scripts/prepare-release.js "${titles[@]}")
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Open or update the release PR
+        if: steps.detect.outputs.release == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.prepare.outputs.version }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B release/next
+          git commit -m "chore: release $VERSION" package.json CHANGELOG.md
+          git push --force "https://x-access-token:$GH_TOKEN@github.com/$GITHUB_REPOSITORY" release/next
+
+          if [ -z "$(gh pr list --head release/next --state open --json number --jq '.[].number')" ]; then
+            gh pr create --base master --head release/next \
+              --title "Release $VERSION" \
+              --body "Merging this uploads $VERSION to Zapier and promotes it. This branch is rebuilt on every push to master, so edit the changelog entry just before you merge, or after."
+          fi

.github/workflows/release.yml

@@ -0,0 +1,92 @@
+name: Release
+
+on:
+  push:
+    branches: [master]
+    paths: ["package.json"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.sha }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Look for a version change
+        id: detect
+        env:
+          BEFORE: ${{ github.event.before }}
+        run: |
+          if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
+            echo "no previous commit to compare against"
+            echo "release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          current=$(node -p "require('./package.json').version")
+          previous=$(git show "$BEFORE:package.json" | node -p "JSON.parse(require('fs').readFileSync(0, 'utf8')).version")
+          if [ "$current" = "$previous" ]; then
+            echo "version unchanged, nothing to do"
+            echo "release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "releasing $previous -> $current"
+          echo "release=true" >> "$GITHUB_OUTPUT"
+          echo "version=$current" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        if: steps.detect.outputs.release == 'true'
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+
+      - name: Install
+        if: steps.detect.outputs.release == 'true'
+        run: yarn install --frozen-lockfile
+
+      - name: Test
+        if: steps.detect.outputs.release == 'true'
+        run: yarn test
+        env:
+          CI: true
+          NODE_ENV: test
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+          LINEAR_TEAM_ID: ${{ secrets.LINEAR_TEAM_ID }}
+
+      - name: Build, validate and upload
+        if: steps.detect.outputs.release == 'true'
+        run: yarn zapier-push
+        env:
+          ZAPIER_DEPLOY_KEY: ${{ secrets.ZAPIER_DEPLOY_KEY }}
+
+      - name: Promote
+        if: steps.detect.outputs.release == 'true'
+        env:
+          ZAPIER_DEPLOY_KEY: ${{ secrets.ZAPIER_DEPLOY_KEY }}
+          VERSION: ${{ steps.detect.outputs.version }}
+        run: |
+          ./node_modules/.bin/zapier-platform promote --yes "$VERSION"
+
+          for attempt in $(seq 1 60); do
+            stage=$(./node_modules/.bin/zapier-platform jobs --format=raw 2>/dev/null \
+              | jq -r --arg v "$VERSION" '[.[] | select(.job_kind == "promote" and .version_to == $v)] | last | .job_stage' 2>/dev/null || true)
+            echo "attempt $attempt: ${stage:-no job yet}"
+            case "$stage" in
+              complete) exit 0 ;;
+              errored|aborted|paused) echo "promotion ended as $stage" >&2; exit 1 ;;
+            esac
+            sleep 20
+          done
+
+          echo "promotion did not finish within 20 minutes" >&2
+          exit 1

.nvmrc

@@ -1 +1 @@
-18.19.1
+22.23.2

README.md

@@ -22,14 +22,15 @@ For testing, save your envvars to `.env`. `.env.default` has the required variab
 
 ### Deployment
 
-Prerequisites:
+Releases are automatic. A bot opens a release PR whenever code that ships has changed since the
+last release. Merging that PR uploads the version to Zapier and promotes it, so new Zaps get it.
 
-- Make sure you have updated the version number in `package.json`.
-- If updating Linear's app, you'll need to have access to Linear's Zapier account and generate a deploy key in `Settings > Deploy Keys`. You can then authenticate with the key using `zapier login --sso`.
+Two things the release does not do. It does not move existing Zaps to the new version, so they
+keep running the version they were built on. It does not deprecate old versions.
 
-You can deploy the app to Zapier with `yarn zapier-push`. This will also run `yarn zapier-validate` before deploying.
-
-After deploying, you'll need to manually promote the version to 'public' in Zapier's dashboard under `App > Manage > Versions`.
+Edit the changelog entry in the release PR before you merge. The bot fills it from pull request
+titles, which is a starting point. The branch is rebuilt on every push to master, so make your
+edit just before you merge.
 
 ## Forking
 

package.json

@@ -11,11 +11,11 @@
     "zapier-push": "npm run zapier-validate && zapier-platform push",
     "prepare": "npm run zapier-build && (husky install || true)",
     "pretest": "npm run zapier-build",
-    "test": "jest --passWithNoTests src/test",
+    "test": "jest --passWithNoTests src/test scripts",
     "prettier": "npx prettier --write ."
   },
   "engines": {
-    "node": ">=18.0.0",
+    "node": ">=22.0.0",
     "npm": ">=10.0.0"
   },
   "dependencies": {
@@ -31,7 +31,8 @@
     "jest": "^29.7.0",
     "lint-staged": ">=10",
     "prettier": "^3.3.3",
-    "typescript": "^5.3.3"
+    "typescript": "^5.3.3",
+    "zapier-platform-cli": "19.1.0"
   },
   "lint-staged": {
     "*.{js,ts,json}": "prettier --write"

scripts/dependencies-changed.js

@@ -0,0 +1,20 @@
+const fs = require("fs");
+
+const canonical = (dependencies = {}) =>
+  JSON.stringify(
+    Object.keys(dependencies)
+      .sort()
+      .map((name) => [name, dependencies[name]])
+  );
+
+const dependenciesChanged = (oldManifest, newManifest) =>
+  canonical(oldManifest.dependencies) !== canonical(newManifest.dependencies);
+
+const read = (file) => JSON.parse(fs.readFileSync(file, "utf8"));
+
+module.exports = { dependenciesChanged };
+
+if (require.main === module) {
+  const [oldFile, newFile] = process.argv.slice(2);
+  process.stdout.write(String(dependenciesChanged(read(oldFile), read(newFile))));
+}

scripts/dependencies-changed.test.js

@@ -0,0 +1,35 @@
+const { dependenciesChanged } = require("./dependencies-changed");
+
+const manifest = (dependencies) => ({ name: "linear-zapier", version: "4.15.0", dependencies });
+
+describe("dependenciesChanged", () => {
+  it("sees a version change", () => {
+    expect(dependenciesChanged(manifest({ lodash: "4.17.21" }), manifest({ lodash: "4.17.22" }))).toBe(true);
+  });
+
+  it("sees an added and a removed dependency", () => {
+    expect(dependenciesChanged(manifest({ lodash: "4.17.21" }), manifest({ lodash: "4.17.21", ky: "1.0.0" }))).toBe(
+      true
+    );
+    expect(dependenciesChanged(manifest({ lodash: "4.17.21", ky: "1.0.0" }), manifest({ lodash: "4.17.21" }))).toBe(
+      true
+    );
+  });
+
+  it("ignores key order", () => {
+    expect(
+      dependenciesChanged(manifest({ lodash: "4.17.21", ky: "1.0.0" }), manifest({ ky: "1.0.0", lodash: "4.17.21" }))
+    ).toBe(false);
+  });
+
+  it("ignores everything outside the dependencies block", () => {
+    const before = { ...manifest({ lodash: "4.17.21" }), devDependencies: { jest: "29.7.0" }, scripts: { test: "a" } };
+    const after = { ...manifest({ lodash: "4.17.21" }), devDependencies: { jest: "30.0.0" }, scripts: { test: "b" } };
+    expect(dependenciesChanged(before, after)).toBe(false);
+  });
+
+  it("treats a missing dependencies block as empty", () => {
+    expect(dependenciesChanged({ name: "x" }, { name: "x" })).toBe(false);
+    expect(dependenciesChanged({ name: "x" }, manifest({ lodash: "4.17.21" }))).toBe(true);
+  });
+});

scripts/prepare-release.js

@@ -0,0 +1,42 @@
+const fs = require("fs");
+const path = require("path");
+
+const ROOT = path.join(__dirname, "..");
+const PACKAGE_FILE = path.join(ROOT, "package.json");
+const CHANGELOG_FILE = path.join(ROOT, "CHANGELOG.md");
+
+const nextMinor = (version) => {
+  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+  if (!parts) {
+    throw new Error(`Unsupported version: ${version}`);
+  }
+  return `${parts[1]}.${Number(parts[2]) + 1}.0`;
+};
+
+const stripPullRequestReference = (title) => title.replace(/\s*\(?#\d+\)?/g, "").trim();
+
+const changelogEntry = (version, titles) => {
+  const bullets = titles.length > 0 ? titles.map(stripPullRequestReference) : ["No description."];
+  return `## ${version}\n\n${bullets.map((title) => `- ${title}`).join("\n")}\n`;
+};
+
+const prependEntry = (changelog, entry) => `${entry}\n${changelog}`;
+
+const main = (titles) => {
+  const manifest = JSON.parse(fs.readFileSync(PACKAGE_FILE, "utf8"));
+  const version = nextMinor(manifest.version);
+
+  manifest.version = version;
+  fs.writeFileSync(PACKAGE_FILE, `${JSON.stringify(manifest, null, 2)}\n`);
+
+  const changelog = fs.readFileSync(CHANGELOG_FILE, "utf8");
+  fs.writeFileSync(CHANGELOG_FILE, prependEntry(changelog, changelogEntry(version, titles)));
+
+  process.stdout.write(version);
+};
+
+module.exports = { nextMinor, changelogEntry, prependEntry };
+
+if (require.main === module) {
+  main(process.argv.slice(2));
+}

scripts/prepare-release.test.js

@@ -0,0 +1,52 @@
+const { nextMinor, changelogEntry, prependEntry } = require("./prepare-release");
+
+describe("nextMinor", () => {
+  it("raises the minor and resets the patch", () => {
+    expect(nextMinor("4.15.0")).toBe("4.16.0");
+    expect(nextMinor("4.15.3")).toBe("4.16.0");
+    expect(nextMinor("4.9.0")).toBe("4.10.0");
+  });
+
+  it("rejects a version it does not understand", () => {
+    expect(() => nextMinor("4.15")).toThrow("Unsupported version");
+    expect(() => nextMinor("v4.15.0")).toThrow("Unsupported version");
+  });
+});
+
+describe("changelogEntry", () => {
+  it("writes one bullet per title", () => {
+    expect(changelogEntry("4.16.0", ["Add a search", "Fix a trigger"])).toBe(
+      "## 4.16.0\n\n- Add a search\n- Fix a trigger\n"
+    );
+  });
+
+  it("stays valid when there are no titles", () => {
+    expect(changelogEntry("4.16.0", [])).toBe("## 4.16.0\n\n- No description.\n");
+  });
+
+  it("strips a trailing parenthesized reference", () => {
+    expect(changelogEntry("4.16.0", ["Add a search (#101)"])).toBe("## 4.16.0\n\n- Add a search\n");
+  });
+
+  it("strips a mid-sentence bare reference", () => {
+    expect(changelogEntry("4.16.0", ["Fix #101 not being closed on merge"])).toBe(
+      "## 4.16.0\n\n- Fix not being closed on merge\n"
+    );
+  });
+
+  it("strips a mid-sentence parenthesized reference", () => {
+    expect(changelogEntry("4.16.0", ["Add (#1) mid-title text"])).toBe("## 4.16.0\n\n- Add mid-title text\n");
+  });
+
+  it("passes through a subject with no reference", () => {
+    expect(changelogEntry("4.16.0", ["Add a new feature"])).toBe("## 4.16.0\n\n- Add a new feature\n");
+  });
+});
+
+describe("prependEntry", () => {
+  it("puts the new entry above the previous one", () => {
+    expect(prependEntry("## 4.15.0\n\n- Older.\n", "## 4.16.0\n\n- Newer.\n")).toBe(
+      "## 4.16.0\n\n- Newer.\n\n## 4.15.0\n\n- Older.\n"
+    );
+  });
+});