Skip to content

ci: harden alpha release publishing #282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fforootd merged 4 commits into from
Jun 13, 2026
Merged

ci: harden alpha release publishing #282

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1fc7639
Block alpha release completion before npm publish
fforootd Jun 13, 2026
57eeac1
Allow GoReleaser recovery when release tag exists
fforootd Jun 13, 2026
4a151f2
ci: tolerate npm dist-tag promotion failures
fforootd Jun 13, 2026
9ca03bd
Merge branch 'main' into codex/investigate-go-release-timing
fforootd Jun 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .changeset/fix-alpha-dist-tag-promotion.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
---
---
4 changes: 2 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -881,8 +881,8 @@ jobs:
# so bare `npx @zitadel/cli` must reach the supported local workflow.
# Keep `alpha` as the canonical prerelease tag, and do not move
# `latest` for SDKs/components, Docker images, or GitHub Releases.
npm dist-tag add "@zitadel/cli@$version" alpha
npm dist-tag add "@zitadel/cli@$version" latest
npm dist-tag add "@zitadel/cli@$version" alpha || echo "::warning::Unable to refresh @zitadel/cli@$version npm alpha dist-tag"
npm dist-tag add "@zitadel/cli@$version" latest || echo "::warning::Unable to promote @zitadel/cli@$version to npm latest dist-tag"

- name: Restore changesets after publish decision
run: git restore -- .changeset
Expand Down
21 changes: 17 additions & 4 deletions apps/cli/tests/unit/scripts/check-alpha-release-plan.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,8 +189,8 @@ describe("check-alpha-release-plan script", () => {
" - name: Promote CLI alpha to npm latest",
" if: ${{ steps.changesets.outputs.published == 'true' }}",
" run: |",
" npm dist-tag add \"@zitadel/cli@$version\" alpha",
" npm dist-tag add \"@zitadel/cli@$version\" latest",
' npm dist-tag add "@zitadel/cli@$version" alpha || echo "::warning::Unable to refresh @zitadel/cli@$version npm alpha dist-tag"',
' npm dist-tag add "@zitadel/cli@$version" latest || echo "::warning::Unable to promote @zitadel/cli@$version to npm latest dist-tag"',
"",
].join("\n"),
"",
Expand Down Expand Up @@ -225,6 +225,19 @@ describe("check-alpha-release-plan script", () => {
).rejects.toThrow("must keep the CLI alpha dist-tag on the published train");
});

it("rejects a workflow that fails the train when npm latest promotion fails", async () => {
const { cwd, statusPath } = await fixtureRepo({
ciWorkflow: validCiWorkflow().replace(
' npm dist-tag add "@zitadel/cli@$version" latest || echo "::warning::Unable to promote @zitadel/cli@$version to npm latest dist-tag"',
' npm dist-tag add "@zitadel/cli@$version" latest',
),
});

await expect(
checkAlphaReleasePlanModule.checkAlphaReleasePlan({ cwd, statusPath }),
).rejects.toThrow("must not fail the alpha train when npm latest dist-tag promotion fails");
});
Comment on lines +228 to +239

it("rejects a workflow that moves the CLI latest tag outside the release job", async () => {
const { cwd, statusPath } = await fixtureRepo({
ciWorkflow: validCiWorkflow()
Expand Down Expand Up @@ -382,8 +395,8 @@ function validCiWorkflow(): string {
" - name: Promote CLI alpha to npm latest",
" if: ${{ steps.changesets.outputs.published == 'true' }}",
" run: |",
" npm dist-tag add \"@zitadel/cli@$version\" alpha",
" npm dist-tag add \"@zitadel/cli@$version\" latest",
' npm dist-tag add "@zitadel/cli@$version" alpha || echo "::warning::Unable to refresh @zitadel/cli@$version npm alpha dist-tag"',
' npm dist-tag add "@zitadel/cli@$version" latest || echo "::warning::Unable to promote @zitadel/cli@$version to npm latest dist-tag"',
"",
" - name: Restore changesets after publish decision",
" run: git restore -- .changeset",
Expand Down
5 changes: 5 additions & 0 deletions scripts/check-alpha-release-plan.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -286,6 +286,11 @@ function assertCliLatestPromotion(ciWorkflow) {
throw new Error("only @zitadel/cli may move the npm latest dist-tag during alpha");
}
}
assertContains(
releaseJob,
'npm dist-tag add "@zitadel/cli@$version" latest ||',
"release-alpha-train must not fail the alpha train when npm latest dist-tag promotion fails",
);
Comment on lines +289 to +293
}

function assertNoUnexpectedPublishOnlyGates(ciWorkflow) {
Expand Down
Loading