ci(zapier): only block overwrite for PUBLIC versions, not private beta #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI/CD for the Zapier integration (packages/zapier). | |
| # Isolated per-package: only runs when packages/zapier (or this file) changes, | |
| # so other packages' releases never interfere. | |
| # | |
| # PR -> check only (tsc + test + schema validate + scoped lint) — no deploy, | |
| # auth-free so it works for fork PRs (repo is public). | |
| # main -> check, then deploy: `zapier push` overwriting the SAME version. | |
| # A guard refuses to overwrite a version that already has Zap users, | |
| # so you only ever bump the version when you'd actually affect users. | |
| # | |
| # App env (CLIENT_ID / CLIENT_SECRET / TEABLE_INSTANCE_URL) lives on Zapier's | |
| # server per version and is preserved across a same-version push — CI never | |
| # touches it. Only secret needed here: ZAPIER_DEPLOY_KEY (repo Settings -> | |
| # Secrets and variables -> Actions). | |
| name: zapier | |
| on: | |
| pull_request: | |
| paths: | |
| - 'packages/zapier/**' | |
| - '.github/workflows/zapier.yml' | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'packages/zapier/**' | |
| - '.github/workflows/zapier.yml' | |
| # Cancel superseded PR runs; never cancel a main deploy mid-flight. | |
| concurrency: | |
| group: zapier-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| defaults: | |
| run: | |
| working-directory: packages/zapier | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: packages/zapier/package-lock.json | |
| - run: npm ci | |
| - name: Typecheck | |
| run: npx tsc --noEmit | |
| - name: Test | |
| run: npm test | |
| - name: Validate schema (no auth needed) | |
| run: npx zapier-platform validate --without-style | |
| deploy: | |
| needs: check | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: packages/zapier/package-lock.json | |
| - run: npm ci | |
| - name: Link app — write .zapierapprc from repo Variables | |
| run: | | |
| if [ -z "${{ vars.ZAPIER_APP_ID }}" ] || [ -z "${{ vars.ZAPIER_APP_KEY }}" ]; then | |
| echo "::error::Set repo Variables ZAPIER_APP_ID and ZAPIER_APP_KEY (Settings -> Secrets and variables -> Actions -> Variables)." | |
| exit 1 | |
| fi | |
| printf '{"id": %s, "key": "%s"}\n' \ | |
| "${{ vars.ZAPIER_APP_ID }}" "${{ vars.ZAPIER_APP_KEY }}" > .zapierapprc | |
| - name: Guard — never overwrite a PUBLIC version that has users | |
| env: | |
| ZAPIER_DEPLOY_KEY: ${{ secrets.ZAPIER_DEPLOY_KEY }} | |
| run: | | |
| VERSION=$(node -p "require('./package.json').version") | |
| ROW=$(npx zapier-platform versions --format json 2>/dev/null \ | |
| | jq -c --arg v "$VERSION" 'map(select(.Version == $v)) | first // {}') | |
| STATE=$(echo "$ROW" | jq -r '.State // "private"') | |
| USERS=$(echo "$ROW" | jq -r '(.["Zap Users"] // "0") | tonumber') | |
| echo "Version $VERSION — state: $STATE, Zap users: $USERS." | |
| # While the version is still private (pre-publish beta), overwrite | |
| # freely — the only live Zaps are your own test users, which you must | |
| # turn on to satisfy Zapier's publishing requirements. Once the version | |
| # is promoted (no longer private) and has real users, refuse to | |
| # overwrite: bump the version and promote instead. | |
| if [ "$STATE" != "private" ] && [ "${USERS:-0}" -gt 0 ]; then | |
| echo "::error::Version $VERSION is $STATE and has $USERS user(s). Bump the version in packages/zapier/package.json, then promote." | |
| exit 1 | |
| fi | |
| - name: Push to Zapier (overwrites the same version) | |
| env: | |
| ZAPIER_DEPLOY_KEY: ${{ secrets.ZAPIER_DEPLOY_KEY }} | |
| run: npx zapier-platform push |