ci: automated release by wenfix · Pull Request #1362 · MetaMask/metamask-sdk

wenfix · 2025-10-08T15:05:46Z

Explanation

Currently there's no automated way to trigger the existing Github Actions responsible for releasing the packages in the repo to NPM.

This PR:

Updates @metamask/create-release-branch to 4.3.1 across all packages.
Updates commitlint.config.js to ignore commits created by @metamask/create-release-branch.
Updates changelog:* scripts across all repos to match @metamask/core for consistency.
Add changelog:format.
Deduplicate@metamask/auto-changelog by moving it to the root and update it to 3.4.3
Pins workspace package versions across the repo as its required by @metamask/create-release-branch

With these changes we're able to do yarn create-release-branch -i to create a Release branch locally. Pushing and merging that branch should trigger publish-release action.

See Test Release branch here

References

Closes WAPI-739

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've highlighted breaking changes using the "BREAKING" category above as appropriate

Note

Automates releases via create-release-branch, standardizes changelog scripts, adds Yarn constraints plugin, pins workspace versions, and updates CI/commitlint to validate and ignore appropriate commits.

CI/CD:
- Validate changelogs in matrix jobs (changelog:validate) and broaden release commit detection patterns.
- Minor workflow cleanups (secrets formatting, no-op whitespace fix).
Changelog Tooling:
- Add changelog:update, changelog:validate, and changelog:format scripts repo-wide; remove old lint:changelog usages.
- Centralize @metamask/auto-changelog at the root and invoke via new scripts.
Release Tooling:
- Bump @metamask/create-release-branch to ^4.1.3 and adjust config; commitlint now ignores "Initialize/Update Release X.Y.Z" commits.
Yarn/Repo Config:
- Add @yarnpkg/plugin-constraints and enable in .yarnrc.yml; fix .gitignore patterns for Yarn directories.
Version Pinning:
- Pin internal workspace dependency versions across packages (e.g., @metamask/sdk, @metamask/sdk-analytics).
Docs:
- Update contributing docs to reference changelog:validate and new script names.
Scripts:
- Add scripts/update-changelog.sh and scripts/format-changelog.sh; enhance validate-changelog.sh to use root binary with --prettier.

^{Written by Cursor Bugbot for commit 0333c58. This will update automatically on new commits. Configure here.}

…se-vibe

socket-security · 2025-10-08T15:23:13Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/body-parser@1.20.3
npm/@metamask/create-release-branch@1.1.0 ⏵ 4.1.3	⁺³		⁺³
npm/express@4.21.2
npm/viem@1.3.1 ⏵ 2.38.0	⁺¹	⁺¹	⁺¹

View full report

socket-security · 2025-10-08T15:23:15Z

Caution

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`npm/@metamask/create-release-branch@4.1.3` has Network access. Module: globalThis["fetch"] Location: Package overview From: package.json → `npm/@metamask/create-release-branch@4.1.3` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@metamask/create-release-branch@4.1.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/ox@0.9.6` has Network access. Module: globalThis["fetch"] Location: Package overview From: `?` → `npm/viem@2.38.0` → `npm/ox@0.9.6` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ox@0.9.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/raw-body@2.5.2` has Network access. Module: http-errors Location: Package overview From: `?` → `npm/body-parser@1.20.3` → `npm/raw-body@2.5.2` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/raw-body@2.5.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/body-parser@1.20.3` has a New author. New Author: ulisesgascon Previous Author: dougwilson From: packages/devsocket/package.json → `npm/body-parser@1.20.3` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/body-parser@1.20.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/express@4.21.2` has a New author. New Author: jonchurch Previous Author: ulisesgascon From: packages/devsocket/package.json → `npm/express@4.21.2` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/express@4.21.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/get-stream@8.0.1` has a New author. New Author: ehmicky Previous Author: sindresorhus From: `?` → `npm/execa@5.1.1` → `npm/get-stream@8.0.1` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/get-stream@8.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/send@0.19.0` has a New author. New Author: ulisesgascon Previous Author: wesleytodd From: `?` → `npm/expo@49.0.17` → `npm/react-native@0.72.7` → `npm/express@4.21.2` → `npm/send@0.19.0` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/send@0.19.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`npm/content-disposition@0.5.4` is a AI-detected potential code anomaly. Notes: The code appears to be a standard, non-malicious Content-Disposition header parser with strict input validation and proper encoding/decoding utilities. No evident data exfiltration or remote execution within this fragment. The primary precaution is to ensure the external decodefield function is safe and that PARAM_REGEXP robustly handles edge-case inputs to prevent DoS or parsing failures. Confidence: 1.00 Severity: 0.60 From: `?` → `npm/serve@14.2.1` → `npm/express@4.21.2` → `npm/content-disposition@0.5.4` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/content-disposition@0.5.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`npm/signal-exit@4.1.0` is a AI-detected potential code anomaly. Notes: The code represents a legitimate signal-exit instrumentation module intended to provide robust exit handling and lifecycle hooks. It does not introduce executable malware or data exfiltration in this fragment. However, it significantly alters process termination behavior and could cause compatibility issues or subtle bugs if used alongside other exit-handling code in extensions. Overall, this is a non-malicious yet potentially risky integration point that should be reviewed for compatibility with other modules in the extension. Confidence: 1.00 Severity: 0.60 From: `?` → `npm/ora@3.4.0` → `npm/execa@5.1.1` → `npm/@lavamoat/allow-scripts@2.3.1` → `npm/jest@29.7.0` → `npm/@jest/globals@29.6.1` → `npm/jest@29.6.1` → `npm/lint-staged@13.2.3` → `npm/expo-asset@8.10.1` → `npm/babel-jest@29.6.4` → `npm/jest@29.6.4` → `npm/@storybook/addon-essentials@7.5.3` → `npm/expo@49.0.17` → `npm/@storybook/cli@7.6.5` → `npm/expo-constants@18.0.9` → `npm/signal-exit@4.1.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/signal-exit@4.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`npm/viem@2.38.0` is a AI-detected potential code anomaly. Notes: The code represents a legitimate and well-structured signing module for a multi-owner wallet with WebAuthn support. It implements standard flows for signing typed data and user operations, and encodes signatures for on-chain verification. No evidence of covert data leakage, backdoors, or malicious behavior is detected within this fragment. Potential risks stem from UI trust boundaries and signer implementation integrity, not from the fragment itself. Confidence: 1.00 Severity: 0.60 From: packages/devnext/package.json → `npm/viem@2.38.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/viem@2.38.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`npm/viem@2.38.0` is a AI-detected potential code anomaly. Notes: The provided ABI fragment represents a standard account abstraction/smart account interface, exposing high-privilege operations (execute, executeBatch) and user operation validation. There is no explicit malicious behavior visible in the ABI itself, but the architectural pattern inherently carries security risk if access control and operation authorization are lax in the implementation. The fragment should be audited alongside the concrete contract to verify proper authorization, nonce management, and safe external calls. Confidence: 1.00 Severity: 0.60 From: packages/devnext/package.json → `npm/viem@2.38.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/viem@2.38.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`npm/viem@2.38.0` is a AI-detected potential code anomaly. Notes: The code implements a cross-chain deposit flow with proper validations, artifact reads, and on-chain interactions. There is no evidence of hidden backdoors, data exfiltration, or malware. The main security considerations relate to token approval logic and correct configuration of flags to avoid granting excessive allowances. Overall, the module appears legitimate for a bridge deposit flow, with moderate risk primarily around configuration of approvals and correct handling of gas/fees. Confidence: 1.00 Severity: 0.60 From: packages/devnext/package.json → `npm/viem@2.38.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/viem@2.38.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

codecov · 2025-10-08T15:48:59Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.99%. Comparing base (aa521c8) to head (0333c58).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1362   +/-   ##
=======================================
  Coverage   74.99%   74.99%           
=======================================
  Files         184      184           
  Lines        4519     4519           
  Branches     1108     1108           
=======================================
  Hits         3389     3389           
  Misses       1130     1130

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

cursor · 2025-10-30T16:42:26Z

+ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+# Format/fix the changelog using prettier
+if [[ "${GITHUB_REF:-}" =~ '^release/' ]]; then


Bug: Regex Mismatch Blocks Release Logic

The regex pattern '^release/' in the GITHUB_REF check is incorrect. GITHUB_REF contains full ref paths (e.g., refs/heads/release/1.0.0), so the condition always evaluates to false. This prevents the scripts from applying release-specific logic, like passing the --rc flag, when on a release branch.

Additional Locations (1)

scripts/validate-changelog.sh#L17-L18

cursor · 2025-10-30T16:42:26Z


 if [[ "${GITHUB_REF:-}" =~ '^release/' ]]; then
-  yarn auto-changelog validate --tag-prefix "${package_name}@" --rc
+  "${ROOT_DIR}/node_modules/.bin/auto-changelog" validate --prettier --tag-prefix "${package_name}@" --rc "$@"


Bug: Regex Pattern Error in Bash Conditional

The bash conditional for detecting release branches uses single quotes around the ^release/ regex pattern. This causes the caret to be interpreted literally, preventing it from correctly matching branches that start with 'release/'.

Additional Locations (1)

scripts/format-changelog.sh#L17-L18

wenfix · 2026-02-02T12:03:08Z

This has been implemented in https://github.com/MetaMask/connect-monorepo.

wenfix added 11 commits October 8, 2025 10:53

chore: update prettier and create-release-branch deps

629dbcd

specify versions on workspace packages

60e2319

temporarily disable commitlint

6855283

update changelog scripts to match core

1a14b2b

move auto-changelog to root and update scripts

32cc123

add format changelog scripts

8e20265

chore: renable commitlint with ignore release rule

cd4bde5

chore: yarn constraints plugins

86036f0

fix: commitlint ignore rule

c2784ea

Merge branch 'ci/automated-release-changelog' into ci/automated-relea…

bff6ae2

…se-vibe

chore: deduplicate changelog validation

2765964

wenfix requested a review from a team as a code owner October 8, 2025 15:05

wenfix added 2 commits October 8, 2025 16:13

fix: gitignore and add plugin-constraints

56d1a6c

chore: is-release action to v2

fecd4be

wenfix added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code team-wallet-integrations labels Oct 8, 2025

chore: format sdk changelog

dc22a8e

This comment was marked as outdated.

Sign in to view

chore: format all changelogs

c50a1ed

This comment was marked as outdated.

Sign in to view

wenfix mentioned this pull request Oct 9, 2025

Release/116.0.0 #1364

Merged

3 tasks

wenfix and others added 2 commits October 9, 2025 15:52

chore: add changelog validation to multichain-react

1593ced

Merge remote-tracking branch 'origin' into ci/automated-release

0333c58

adonesky1 requested a review from a team as a code owner October 30, 2025 16:39

cursor Bot reviewed Oct 30, 2025

View reviewed changes

wenfix closed this Feb 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

ci: automated release#1362

ci: automated release#1362
wenfix wants to merge 17 commits into
mainfrom
ci/automated-release

wenfix commented Oct 8, 2025 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Oct 8, 2025 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 8, 2025 •

edited

Loading

Uh oh!

codecov Bot commented Oct 8, 2025 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

cursor Bot Oct 30, 2025

Uh oh!

cursor Bot Oct 30, 2025

Uh oh!

wenfix commented Feb 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

wenfix commented Oct 8, 2025 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

References

Checklist

Uh oh!

socket-security Bot commented Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

cursor Bot Oct 30, 2025

Choose a reason for hiding this comment

Bug: Regex Mismatch Blocks Release Logic

Uh oh!

cursor Bot Oct 30, 2025

Choose a reason for hiding this comment

Bug: Regex Pattern Error in Bash Conditional

Uh oh!

wenfix commented Feb 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

wenfix commented Oct 8, 2025 •

edited by cursor Bot

Loading

socket-security Bot commented Oct 8, 2025 •

edited

Loading

socket-security Bot commented Oct 8, 2025 •

edited

Loading

codecov Bot commented Oct 8, 2025 •

edited

Loading