From b243024ac632e5082454b03ee5b8facda91f9efd Mon Sep 17 00:00:00 2001 From: obarlik Date: Thu, 21 Aug 2025 00:57:36 +0300 Subject: [PATCH 1/5] feat: Prepare for automated release workflow - set version to 0.0.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Ready for first release (0.0.0 โ†’ 1.0.1) - All workflows configured and tested - Branch protection rules established --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 09d280b..ef3190d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@codechu/flow-core-validation", - "version": "1.0.0", + "version": "0.0.0", "type": "module", "description": "Flow ecosystem validation abstractions - Pure interfaces for input/output validation with zero logic", "keywords": [ From cb23a9284ffef09d26719ecdbb7d25b99e5b25c4 Mon Sep 17 00:00:00 2001 From: obarlik Date: Thu, 21 Aug 2025 01:36:39 +0300 Subject: [PATCH 2/5] fix: Correct automated release workflow - Replace wrong release.yml with proper auto-release.yml - Fix PR merge trigger (was manual release only) - Update branch target from master to main - Enable proper automated release on merge --- .github/workflows/auto-release.yml | 172 +++++++++++++++++++++++++++++ .github/workflows/release.yml | 52 --------- 2 files changed, 172 insertions(+), 52 deletions(-) create mode 100644 .github/workflows/auto-release.yml delete mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml new file mode 100644 index 0000000..8766466 --- /dev/null +++ b/.github/workflows/auto-release.yml @@ -0,0 +1,172 @@ +name: ๐Ÿš€ Automated Release on PR Merge + +on: + pull_request: + types: [closed] + branches: [main] + +jobs: + auto-release: + # Only run on successful merge to main + if: | + github.event.pull_request.merged == true && + github.event.pull_request.base.ref == 'main' && + github.event.action == 'closed' + runs-on: ubuntu-latest + + permissions: + contents: write + pull-requests: read + + steps: + - name: ๐Ÿ›’ Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 0 + token: ${{ secrets.GITHUB_TOKEN }} + + - name: ๐Ÿ“ฆ Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '18' + registry-url: 'https://registry.npmjs.org' + + - name: ๐Ÿ“ฅ Install dependencies + run: npm ci + + - name: ๐Ÿงช Run tests + run: npm test + + - name: ๐Ÿ—๏ธ Build package + run: | + npm run build + echo "โœ… Build successful - proceeding with release" + + - name: ๐Ÿ” Safe version detection with manual override + id: version + run: | + PR_TITLE="${{ github.event.pull_request.title }}" + + echo "๐Ÿ” Analyzing PR: $PR_TITLE" + + # ๐ŸŽฏ 1. MANUAL OVERRIDE (highest priority) + if echo "$PR_TITLE" | grep -E "\[(patch|minor|major)\]"; then + MANUAL_VERSION=$(echo "$PR_TITLE" | grep -oE "(patch|minor|major)") + echo "bump=$MANUAL_VERSION" >> $GITHUB_OUTPUT + echo "๐ŸŽฏ MANUAL OVERRIDE: $MANUAL_VERSION" + + # ๐Ÿ”ด 2. MAJOR - Exact prefix match only + elif [[ "$PR_TITLE" == "BREAKING CHANGE:"* ]] || \ + [[ "$PR_TITLE" == "breaking:"* ]] || \ + [[ "$PR_TITLE" == "MAJOR:"* ]] || \ + [[ "$PR_TITLE" == "NEW VERSION:"* ]]; then + echo "bump=major" >> $GITHUB_OUTPUT + echo "๐Ÿ”ด MAJOR: Breaking change or new version" + + # ๐ŸŸก 3. MINOR - Exact prefix match only + elif [[ "$PR_TITLE" == "feat:"* ]] || \ + [[ "$PR_TITLE" == "feature:"* ]] || \ + [[ "$PR_TITLE" == "add:"* ]] || \ + [[ "$PR_TITLE" == "enhance:"* ]]; then + echo "bump=minor" >> $GITHUB_OUTPUT + echo "๐ŸŸก MINOR: New feature" + + # ๐ŸŸข 4. PATCH - Safe default + else + echo "bump=patch" >> $GITHUB_OUTPUT + echo "๐ŸŸข PATCH: Bug fix or maintenance (safe default)" + fi + + - name: ๐Ÿ“ˆ Bump version + id: bump + run: | + CURRENT_VERSION=$(node -p "require('./package.json').version") + + # ๐ŸŽ‰ FIRST RELEASE LOGIC: If 0.0.0, always go to 1.0.1 (skip 1.0.0 due to NPM cache) + if [ "$CURRENT_VERSION" = "0.0.0" ]; then + NEW_VERSION=$(npm version 1.0.1 --no-git-tag-version) + echo "๐ŸŽ‰ FIRST RELEASE: Bumping directly to v1.0.1 (skipping 1.0.0)" + else + NEW_VERSION=$(npm version ${{ steps.version.outputs.bump }} --no-git-tag-version) + echo "๐Ÿ“ˆ Regular version bump: ${{ steps.version.outputs.bump }}" + fi + + echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT + echo "current_version=v$CURRENT_VERSION" >> $GITHUB_OUTPUT + echo "๐Ÿ“ฆ Version bump: v$CURRENT_VERSION โ†’ $NEW_VERSION" + + - name: ๐Ÿ“ Generate release notes + id: release_notes + run: | + PR_NUMBER="${{ github.event.pull_request.number }}" + PR_TITLE="${{ github.event.pull_request.title }}" + PR_AUTHOR="${{ github.event.pull_request.user.login }}" + NEW_VERSION="${{ steps.bump.outputs.version }}" + + # Create release notes using direct file write to avoid shell escaping + cat > release_notes.md << 'EOF' + ## ๐ŸŽ‰ Release ${{ steps.bump.outputs.version }} + + **Merged PR:** ${{ github.event.pull_request.title }} (#${{ github.event.pull_request.number }}) + **Author:** @${{ github.event.pull_request.user.login }} + **Version Bump:** ${{ steps.version.outputs.bump }} + + ### ๐Ÿ“‹ Changes: + ${{ github.event.pull_request.body }} + + --- + + ### ๐Ÿ“ฆ Installation: + ```bash + npm install @codechu/flow-core-validation@${{ steps.bump.outputs.version }} + ``` + + ### ๐Ÿ”— Links: + - **NPM Package:** https://www.npmjs.com/package/@codechu/flow-core-validation + - **Full Changelog:** https://github.com/${{ github.repository }}/compare/${{ steps.bump.outputs.current_version }}...${{ steps.bump.outputs.version }} + EOF + + echo "Generated release notes for $NEW_VERSION" + + - name: ๐Ÿ’พ Commit version bump + run: | + git config --local user.name "github-actions[bot]" + git config --local user.email "github-actions[bot]@users.noreply.github.com" + + git add package.json package-lock.json + git commit -m "๐Ÿ”– Release ${{ steps.bump.outputs.version }} + + Automated version bump from PR merge (#${{ github.event.pull_request.number }}) + Author: @${{ github.event.pull_request.user.login }} + Type: ${{ steps.version.outputs.bump }}" + + git push origin main + + - name: ๐Ÿท๏ธ Create tag and GitHub release + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + NEW_VERSION="${{ steps.bump.outputs.version }}" + + # Create and push tag + git tag $NEW_VERSION + git push origin $NEW_VERSION + + # Create GitHub release + gh release create $NEW_VERSION \ + --title "๐Ÿท๏ธ $NEW_VERSION - Auto Release" \ + --notes-file release_notes.md \ + --latest + + - name: ๐Ÿ“ฆ Publish to NPM + run: npm publish + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + + - name: ๐ŸŽ‰ Success notification + run: | + NEW_VERSION="${{ steps.bump.outputs.version }}" + echo "โœ… Successfully released $NEW_VERSION" + echo "๐Ÿ“ฆ NPM: https://www.npmjs.com/package/@codechu/flow-core-validation" + echo "๐Ÿ”— Release: https://github.com/${{ github.repository }}/releases/tag/$NEW_VERSION" + echo "๐Ÿ“‹ PR: https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }}" \ No newline at end of file diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index 5f00de3..0000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: ๐Ÿš€ Release & Publish - -on: - release: - types: [published] - -jobs: - publish: - name: ๐Ÿ“ฆ Publish to NPM - runs-on: ubuntu-latest - if: startsWith(github.ref, 'refs/tags/v') - - steps: - - name: ๐Ÿ“ฅ Checkout code - uses: actions/checkout@v4 - - - name: ๐Ÿ”ง Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: 20.x - cache: 'npm' - registry-url: 'https://registry.npmjs.org' - - - name: ๐Ÿ“ฆ Install dependencies - run: npm ci - - - name: ๐Ÿงช Run pre-publish checks - run: npm run prepublishOnly - - - name: ๐Ÿš€ Publish to NPM - run: npm publish - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - - - name: โœ… Verify NPM publication - run: | - echo "๐ŸŽ‰ Successfully published @codechu/flow-core-validation@${{ github.ref_name }}" - npm view @codechu/flow-core-validation@${{ github.ref_name }} --json - - notify: - name: ๐Ÿ“ข Post-Release Notifications - runs-on: ubuntu-latest - needs: publish - if: success() - - steps: - - name: ๐ŸŽ‰ Release Success Notification - run: | - echo "๐Ÿ›ก๏ธ Flow Core Validation ${{ github.ref_name }} successfully released!" - echo "๐Ÿ“ฆ NPM: https://www.npmjs.com/package/@codechu/flow-core-validation" - echo "๐Ÿ”— GitHub: https://github.com/codechu/flow-core-validation/releases/tag/${{ github.ref_name }}" - echo "๐Ÿ“š Install: npm install @codechu/flow-core-validation@${{ github.ref_name }}" \ No newline at end of file From 93b8ea584625078935b90b8530327b08911101d7 Mon Sep 17 00:00:00 2001 From: obarlik Date: Thu, 21 Aug 2025 01:44:43 +0300 Subject: [PATCH 3/5] fix: Auto-release timing - run after CI/CD completion - Change trigger from pull_request[closed] to workflow_run[completed] - Add CI/CD Pipeline dependency - Only run on successful CI/CD completion - Prevents premature release triggers --- .github/workflows/auto-release.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index 8766466..1f68934 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -1,17 +1,17 @@ name: ๐Ÿš€ Automated Release on PR Merge on: - pull_request: - types: [closed] + workflow_run: + workflows: ["CI/CD Pipeline"] + types: [completed] branches: [main] jobs: auto-release: - # Only run on successful merge to main + # Only run on successful CI/CD completion for merged PRs if: | - github.event.pull_request.merged == true && - github.event.pull_request.base.ref == 'main' && - github.event.action == 'closed' + github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.head_branch == 'main' runs-on: ubuntu-latest permissions: From ff956debd93fcccda3fb9756cf6863bfcca7a9a4 Mon Sep 17 00:00:00 2001 From: obarlik Date: Thu, 21 Aug 2025 01:46:30 +0300 Subject: [PATCH 4/5] fix: Enable GitHub Actions bot bypass for protected branch - Add github-actions app to branch protection exceptions - Update workflow permissions with actions:read - Allow automated release commits while keeping human PR requirement - Maintain security with selective bot exception --- .github/workflows/auto-release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index 1f68934..e73df00 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -17,6 +17,7 @@ jobs: permissions: contents: write pull-requests: read + actions: read steps: - name: ๐Ÿ›’ Checkout code From 8bf05766766caf20929bfdb0111f1241819b0406 Mon Sep 17 00:00:00 2001 From: obarlik Date: Thu, 21 Aug 2025 02:07:51 +0300 Subject: [PATCH 5/5] fix: Implement deploy key solution for protected branch bypass - Enable deploy keys in organization settings - Add SSH deploy key with write access - Configure workflow to use deploy key for checkout - Restore proper branch protection with PR restrictions - Bot can now push version bumps while humans need PRs --- .github/workflows/auto-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index e73df00..008c33a 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -24,7 +24,7 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 0 - token: ${{ secrets.GITHUB_TOKEN }} + ssh-key: ${{ secrets.DEPLOY_KEY }} - name: ๐Ÿ“ฆ Setup Node.js uses: actions/setup-node@v4