ci: fix runtime publish (tag/Node), commit regenerated runtime back, auto-commit sponsor image (#5647)

* ci(npm): publish prerelease as latest + bump CI Node to 22

The OIDC migration (#5646) authenticates correctly but `npm publish` fails
on npm >= 11 with 'You must specify a tag using --tag when publishing a
prerelease version' — the old JS-DevTools action defaulted to `latest`
implicitly. v3 intentionally ships alpha.N as the default dist-tag (the
templates pin "@wailsio/runtime": "latest"), so publish with --tag latest.

Also bump the CI Node from the deprecated 20 to 22 (LTS).

* ci(npm): verify generated artifacts + commit regenerated runtime to master

Harden the publish flow per the existing regenerate-before-publish design:
- add a Verify step that fails the job if (re)generation didn't produce the
  expected outputs (bundled runtime + npm dist/), catching silent build
  failures before anything is published or committed.
- make the commit-back explicit: 'git add -A' sweeps every regenerated tracked
  file (bundled runtime in internal/assetserver/bundledassets, generated
  pkg/events/events.go, TypeDoc output) back to master alongside the version
  bump; log 'git status' so the committed set is visible. dist/ is gitignored
  and is rebuilt fresh by prepack at publish time.

* ci(sponsors): auto-commit sponsor image instead of opening a PR

Push the regenerated website/static/img/sponsors.svg straight to master
(no-op when unchanged) using the bypass-capable WAILS_REPO_TOKEN, matching
publish-npm.yml, rather than opening a daily 'update sponsors' PR. Also
modernise the actions (checkout v3->v4, setup-node v2->v4, Node 20->22).

---------

Co-authored-by: Lea Anthony <lea.anthony@gmail.com>

Author: taliesin-ai

.github/workflows/generate-sponsor-image.yml

@@ -10,31 +10,34 @@ jobs:
     name: Update Sponsors
     runs-on: ubuntu-latest
     if: github.repository == 'wailsapp/wails'
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          # Use the bypass-capable token so the auto-commit can push directly
+          # to the protected master branch (same pattern as publish-npm.yml).
+          token: ${{ secrets.WAILS_REPO_TOKEN || github.token }}
 
       - name: Set Node
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v4
         with:
-          node-version: 20.x
+          node-version: "22"
 
       - name: Update Sponsors
         run: cd scripts/sponsors && chmod 755 ./generate-sponsor-image.sh && ./generate-sponsor-image.sh
         env:
           SPONSORKIT_GITHUB_TOKEN: ${{ secrets.SPONSORS_TOKEN }}
           SPONSORKIT_GITHUB_LOGIN: wailsapp
 
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v6
-        with:
-          commit-message: "chore: update sponsors.svg"
-          add-paths: "website/static/img/sponsors.svg"
-          title: "chore: update sponsors.svg"
-          body: |
-            Auto-generated by the sponsor image workflow
-            
-            [skip ci] [skip actions]
-          branch: update-sponsors
-          base: master
-          delete-branch: true
-          draft: false
+      - name: Commit updated sponsor image
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          if git diff --quiet -- website/static/img/sponsors.svg; then
+            echo "No sponsor changes to commit."
+            exit 0
+          fi
+          git add website/static/img/sponsors.svg
+          git commit -m "chore: update sponsors.svg [skip ci]"
+          git push

.github/workflows/publish-npm.yml

@@ -78,10 +78,10 @@ jobs:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Use Node.js 20
+      - name: Use Node.js 22
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
 
       - name: Upgrade npm for Trusted Publishing
         # Trusted Publishing (OIDC) requires npm >= 11.5.1.
@@ -109,15 +109,43 @@ jobs:
           npm test
           npm run build
 
+      - name: Verify generated artifacts
+        # Fail the publish if (re)generation did not produce the expected
+        # outputs — both the npm package payload (dist/, gitignored, what gets
+        # published) and the tracked bundled runtime that is committed back to
+        # master below. A missing/empty file here means a silent build failure.
+        working-directory: v3
+        run: |
+          set -euo pipefail
+          required=(
+            "internal/assetserver/bundledassets/runtime.js"
+            "internal/assetserver/bundledassets/runtime.debug.js"
+            "internal/runtime/desktop/@wailsio/runtime/dist/runtime.js"
+          )
+          for f in "${required[@]}"; do
+            if [ ! -s "$f" ]; then
+              echo "::error::expected generated artifact missing or empty: v3/$f"
+              exit 1
+            fi
+          done
+          echo "All expected runtime artifacts were generated."
+
       - name: Bump version
         id: bump-version
         working-directory: v3/internal/runtime/desktop/@wailsio/runtime
         run: |
           echo "version=$(npm --no-git-tag-version --force version prerelease)" >> "$GITHUB_OUTPUT"
 
-      - name: Commit changes
+      - name: Commit regenerated runtime + version bump
+        # Commit ALL regenerated tracked files back to master, not just the
+        # version bump: the bundled runtime (internal/assetserver/bundledassets),
+        # generated events (v3/pkg/events/events.go) and TypeDoc output all come
+        # from `task runtime:build` and must stay in sync with the published
+        # package. dist/ is gitignored, so `git add -A` will not commit it.
         run: |
-          git add .
+          git add -A
+          echo "Files committed back to master:"
+          git status --short
           git commit -m "[skip ci] Publish @wailsio/runtime ${{ steps.bump-version.outputs.version }}"
           git push
 
@@ -127,4 +155,7 @@ jobs:
         # Requires a Trusted Publisher to be configured for @wailsio/runtime on
         # npmjs.com (repo: wailsapp/wails, workflow: publish-npm.yml).
         working-directory: v3/internal/runtime/desktop/@wailsio/runtime
-        run: npm publish --access public
+        # --tag latest: v3 ships prerelease (alpha.N) as the default dist-tag,
+        # matching the templates' "@wailsio/runtime": "latest" pin. npm >= 11
+        # requires an explicit --tag to publish a prerelease as latest.
+        run: npm publish --access public --tag latest