chore: add publish workflow - #11
Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces a release/publish automation flow built around GitHub draft releases: a scheduled/manual workflow detects a draft release and opens a version-bump PR, and a publish workflow runs on merge to publish to npm and finalize GitHub release notes using git-cliff.
Changes:
- Add
release-start.ymlto poll for draft releases and open arelease/v*version-bump PR. - Add
publish.ymlto run tests/build, publish to npm via trusted publishing, and publish/update the GitHub release with git-cliff notes. - Add
cliff.tomlfor structured release notes generation; add Angular CLI analytics config inangular.json.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
cliff.toml |
Adds git-cliff configuration used to generate organized release notes. |
angular.json |
Adds Angular CLI analytics configuration. |
.github/workflows/release-start.yml |
Adds scheduled/manual workflow to detect draft releases and open a release version-bump PR. |
.github/workflows/publish.yml |
Adds workflow to publish to npm on merged release PRs and finalize the GitHub release using git-cliff. |
Suppressed comments (2)
.github/workflows/release-start.yml:61
- Same pagination issue here: without
per_page(and/or paging), the latest draft release might not be included in the first page of results.
TAG=$(gh api "repos/${GITHUB_REPOSITORY}/releases" \
--jq '[.[] | select(.draft == true)] | sort_by(.created_at) | last | .tag_name // empty')
.github/workflows/publish.yml:83
- Same as the publish job: checking out
ref: maincan include commits beyond the merged release PR by the time this runs, which can skew git-cliff output and release targeting. Check out the merge commit SHA so notes/tagging are computed from the exact released revision.
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
ref: main
fetch-depth: 0 # git-cliff needs full history and tags
persist-credentials: false
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
c8fd4a6 to
9a82ca2
Compare
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | ||
| with: | ||
| node-version: 24 | ||
| cache: 'pnpm' |
There was a problem hiding this comment.
does using a cache in the publish job open us up to the risk of cache poisoning?
|
|
||
| on: | ||
| schedule: | ||
| - cron: '*/15 * * * *' # poll for new draft releases |
There was a problem hiding this comment.
do we get any benefit from the "create a draft release" flow? versus just executing this job via workflow_dispatch directly? Running this poll every 15min is a lot of no-op runs.
| run: pnpm run build:lib | ||
|
|
||
| - name: Update npm CLI (trusted publishing requires npm >= 11.5.1) | ||
| run: npm install -g npm@^11.5.1 |
There was a problem hiding this comment.
would node 24 from setup-node come with an up to date version of npm that makes this unnecessary?
| env: | ||
| VERSION: ${{ steps.version.outputs.version }} | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # for git-cliff's contributor lookup | ||
| run: npx --yes git-cliff@2.13.1 --unreleased --tag "v$VERSION" --strip all --output release-notes.md |
There was a problem hiding this comment.
installing git-cliff in a job with a write token could be a security gap. can we generate the release notes in a separate job?
Description
Add Publish workflow:
Related issues
Fixes #
Type of change
Breaking changes
None
Test plan
npm run buildnpm testnpm run lintChecklist
Additional context