Skip to content

chore(release): version packages - #36

Merged
ryanleecode merged 1 commit into
masterfrom
changeset-release/master
Aug 23, 2026
Merged

chore(release): version packages#36
ryanleecode merged 1 commit into
masterfrom
changeset-release/master

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Consumes pending .changeset/ intents.

Merging publishes packages with provenance attestations and creates GitHub releases.

@github-actions github-actions Bot added the release Automated version-packages release PR label Aug 23, 2026
@ryanleecode
ryanleecode merged commit 2f566db into master Aug 23, 2026
systemfsoftware-maker added a commit that referenced this pull request Aug 23, 2026
…equest ref

Root cause of "there is no release": the publish hung off
`pull_request: types: [closed]` for the release PR, so it ran against
refs/pull/<n>/merge. Merging that PR with branch deletion destroys the ref,
and GitHub then cancels the queued run before any job starts.

Evidence for the merge of PR #36 (the release PR, merged 01:24:36):
  run 32610283678  event=pull_request  conclusion=cancelled  jobs=0
  changeset-release/master  ->  deleted, no longer on the remote
The concurrent push-to-master run carried only the `version` job, which is a
no-op once the intents are consumed. Result: manifest at 0.1.5, zero pending
changesets, no v0.1.5 tag, npm still on the 0.0.0-dummy-npm bootstrap. The
trigger was destroyed by the act of merging, and nothing reported a failure.

Both phases now hang off `push: branches: [master]` and a `plan` job selects
between them from durable state (plan-release.ts):
  pending .changeset intents  -> phase=version
  manifest version untagged   -> phase=publish
  version already tagged      -> phase=none

This also makes a half-finished release resumable: the missing tag still says
"publish", so re-running the workflow retries instead of stranding the version.

Verified plan-release.ts in all three states: real tree -> publish; with a
pending intent -> version; with v0.1.5 tagged -> none.
ryanleecode pushed a commit that referenced this pull request Aug 23, 2026
…ase trigger that survives the merge (#39)

* fix(ci): pin every action to a Node 24 runtime and drop the Node 20 deprecation

Every action targeting Node 20 was being force-run on Node 24 by the runner,
which is what the deprecation warning reports. Resolved each action's first
major with a node24 runtime by reading its own action.yml, then pinned that
release by SHA:

  actions/checkout            v4 -> v5.1.0   node24
  actions/cache               v4 -> v5.1.0   node24
  actions/setup-node          v4 -> v5.0.0   node24
  actions/upload-artifact     v4 -> v6.0.0   node24  (v5 is still node20)
  actions/download-artifact   v4 -> v7.0.0   node24  (v5, v6 are still node20)
  pnpm/action-setup           v4 -> v6.0.10  node24

The artifact actions are why this needed measuring rather than a blanket "+1
major": upload-artifact only reaches node24 at v6, and download-artifact only
at v7. Verified the inputs in use survive the jump -- upload keeps name/path/
if-no-files-found, download keeps pattern/path/merge-multiple.

Unchanged, verified as not the source of the warning: setup-rust-toolchain is
a composite action, rhysd/actionlint is Docker-based, and denoland/setup-deno
is already node24.

Breaking change handled: checkout v5 flips persist-credentials to false.
The two jobs that push with plain git -- create-or-update-release-pr.ts in
`version`, tag-released-packages.ts in `publish` -- set it back to true
explicitly. Every other checkout keeps the safer new default.

* fix(ci): make the actionlint gate actually lint the files it names

The remaining annotation on every run was "Unexpected input(s) 'paths', valid
inputs are ['entryPoint', 'args']". Cause: rhysd/actionlint ships no action.yml
-- the repo root has only a Dockerfile -- so GitHub treats it as an implicit
Docker action accepting entryPoint/args and nothing else. The `paths:` input
was silently discarded, so the step linted the container's default target
rather than ci.yml and release.yml. A gate keyed on an input the runner throws
away certifies nothing.

Run the pinned image directly, digest-pinned, with the workflow files as real
arguments -- the same invocation used to verify locally.

Falsified, not assumed: clean tree -> exit 0; with a bogus `github.no_such_field`
context reference injected into ci.yml -> exit 1 with
'property "no_such_field" is not defined in object type ...'. The gate can fail,
which is the only reason to keep it.

* fix(release): trigger the publish from repository state, not a pull-request ref

Root cause of "there is no release": the publish hung off
`pull_request: types: [closed]` for the release PR, so it ran against
refs/pull/<n>/merge. Merging that PR with branch deletion destroys the ref,
and GitHub then cancels the queued run before any job starts.

Evidence for the merge of PR #36 (the release PR, merged 01:24:36):
  run 32610283678  event=pull_request  conclusion=cancelled  jobs=0
  changeset-release/master  ->  deleted, no longer on the remote
The concurrent push-to-master run carried only the `version` job, which is a
no-op once the intents are consumed. Result: manifest at 0.1.5, zero pending
changesets, no v0.1.5 tag, npm still on the 0.0.0-dummy-npm bootstrap. The
trigger was destroyed by the act of merging, and nothing reported a failure.

Both phases now hang off `push: branches: [master]` and a `plan` job selects
between them from durable state (plan-release.ts):
  pending .changeset intents  -> phase=version
  manifest version untagged   -> phase=publish
  version already tagged      -> phase=none

This also makes a half-finished release resumable: the missing tag still says
"publish", so re-running the workflow retries instead of stranding the version.

Verified plan-release.ts in all three states: real tree -> publish; with a
pending intent -> version; with v0.1.5 tagged -> none.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release Automated version-packages release PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant