-
Notifications
You must be signed in to change notification settings - Fork 0
ci: replace direct-push release with a PR-based release flow #79
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| #!/usr/bin/env node | ||
| /* global process, console */ | ||
| // Phase 1 of the PR-based release flow (task_1788457898992, Aaron ruling | ||
| // "pipeline: pr-flow"). Computes the next version + release notes via | ||
| // semantic-release's own Node API in --dry-run mode -- this is the safe, | ||
| // documented, side-effect-free primitive (no git write, no tag push, no npm | ||
| // publish, no GitHub release; verified this is a real behavioral guarantee | ||
| // of dry-run, not something this script has to enforce itself). Bumps | ||
| // package.json and CHANGELOG.md locally so the caller workflow can commit | ||
| // them to a PR branch instead of semantic-release's own @semantic-release/git | ||
| // pushing straight to protected main (GH006). | ||
| // | ||
| // Writes GITHUB_OUTPUT keys: release_needed, version. Notes are written to | ||
| // CHANGELOG.md directly (same as @semantic-release/changelog would) rather | ||
| // than passed through GITHUB_OUTPUT, since release notes can contain | ||
| // characters/length that don't survive that path cleanly. | ||
| import semanticRelease from "semantic-release"; | ||
| import { readFileSync, writeFileSync, appendFileSync } from "node:fs"; | ||
| import { execSync } from "node:child_process"; | ||
|
|
||
| const result = await semanticRelease({ dryRun: true, ci: false }); | ||
|
|
||
| const githubOutput = process.env.GITHUB_OUTPUT; | ||
| if (!result) { | ||
| console.log("No release needed."); | ||
| if (githubOutput) appendFileSync(githubOutput, "release_needed=false\n"); | ||
| process.exit(0); | ||
| } | ||
|
|
||
| const { version, notes } = result.nextRelease; | ||
| console.log(`Next release: ${version}`); | ||
|
|
||
| // Bump package.json without creating a git tag or committing -- pure file | ||
| // write, same command @semantic-release/npm uses internally for this step. | ||
| execSync(`npm version ${version} --no-git-tag-version --allow-same-version`, { | ||
| stdio: "inherit", | ||
| }); | ||
|
|
||
| // Prepend to CHANGELOG.md, matching @semantic-release/changelog's own | ||
| // convention (newest release on top) so this stays a drop-in for repos that | ||
| // already have history in this format. | ||
| const changelogPath = "CHANGELOG.md"; | ||
| let existing = ""; | ||
| try { | ||
| existing = readFileSync(changelogPath, "utf8"); | ||
| } catch { | ||
| // No CHANGELOG.md yet -- fine, this is the first entry. | ||
| } | ||
| writeFileSync(changelogPath, `${notes}\n\n${existing}`.trimEnd() + "\n"); | ||
|
|
||
| if (githubOutput) { | ||
| appendFileSync(githubOutput, "release_needed=true\n"); | ||
| appendFileSync(githubOutput, `version=${version}\n`); | ||
| } | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Sensitive Data Exposure (CWE-200): Exposure of Sensitive Information to an Unauthorized Actor
Reachability: External · Exploitability: Difficult
Use an npm token for prepare-mode authentication.
The prepare workflow sets
NODE_AUTH_TOKENtosecrets.GITHUB_TOKENbeforescripts/prepare-release.mjsruns semantic-release. Because@semantic-release/npmhasnpmPublish: true, the dry-run verification can send the GitHub token as an npm bearer token. Remove this mapping or provide a dedicated npm token.🤖 Prompt for AI Agents
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: WYRE-AI/node-syncro
Length of output: 10426
🏁 Script executed:
Repository: WYRE-AI/node-syncro
Length of output: 6563
🌐 Web query:
semantic-release v25 dryRun verifyConditions@semantic-release/npmverifyConditions authentication registry💡 Result:
In semantic-release (including v25), the dry-run mode is designed to provide a preview of the release process without performing side effects like publishing packages or pushing commits [1][2]. However, the behavior of the
verifyConditionsstep remains consistent regardless of whether dry-run is enabled [3][2]. Key points regardingverifyConditions,dryRun, and@semantic-release/npm: 1. Verification is Enforced: TheverifyConditionsstep is responsible for validating that the necessary configuration, environment, and authentication methods (such as registry tokens or OIDC configuration) are correct [4][3]. Because this step is intended to identify configuration issues before the process reaches the actual publish/prepare stages, semantic-release always executesverifyConditions, even in dry-run mode [1][3][2]. 2. Authentication Requirements: For@semantic-release/npm, theverifyConditionsstep checks for valid npm authentication, such as theNPM_TOKENenvironment variable, an.npmrcfile, or OIDC trusted publishing credentials [5][6]. If these conditions are not met, the process will fail during the verification phase, even if you are using--dry-run[1][2]. 3. Git Permission Checks: Note that in addition to plugin-specific verification (like npm authentication), semantic-release's core also verifies repository push permissions during dry-run mode to help identify potential issues, even though no actual push will occur [1][2]. 4. OIDC Context: Since v25 of semantic-release upgrades its dependencies (including@semantic-release/npmv13+), it fully supports OIDC trusted publishing [7]. If you are using OIDC, theverifyConditionsstep will validate that the environment is correctly set up for OIDC credential exchange [7]. In summary, dry-run mode skips theprepare,publish,addChannel,success, andfailsteps, but it does not skipverifyConditions[1][2]. If yourverifyConditionsstep fails due to missing or invalid authentication/registry configuration, the dry-run will terminate with an error [1][2].Citations:
🏁 Script executed:
Repository: WYRE-AI/node-syncro
Length of output: 27495
🏁 Script executed:
Repository: WYRE-AI/node-syncro
Length of output: 6651
🏁 Script executed:
Repository: WYRE-AI/node-syncro
Length of output: 4454
Do not require npm authentication during preparation.
When no registry credential exists in
.npmrc,@semantic-release/npm13.1.5 reads onlyNPM_TOKEN; it ignoresNODE_AUTH_TOKEN. Because dry-run executesverifyConditions, the configured plugin can fail againstnpm.pkg.github.combefore the script writesrelease_needed. Exclude@semantic-release/npmfrom preparation, or provideNPM_TOKENonly when npm verification is required.🤖 Prompt for AI Agents