* feat(scaffold): fully automate release blog post publishing
Eliminates the manual PR-review step from the release blog scaffold pipeline.
The workflow now commits the generated post directly to sencho-website main.
scaffold-release-post.mjs changes:
- Remove renderPrBody and all body_file handling
- Update findLastAnchor to accept any post with a version: field, not just
category: release posts. This allows narrative retrospectives to anchor
the 5-release window.
- Add buildHeadline: generates a post title from the top two added items and
the total item count, e.g. "Sencho v0.69: Custom OIDC provider, Trivy
scanning, and 12 more"
- Add buildDescription: auto-generates a ~160-char SEO description from the
version range and top three added items
- Add calcReadingTime: estimates reading time from changelog word count
- Add coveredVersionsProse: formats "v0.65.0 through v0.69.0"
- Add updateMeta: inserts the new post into src/data/blog/meta.ts for
Worker-side SEO meta injection
- Remove the tmpdir/os import (no longer needed)
release-blog-template.tsx.tmpl changes:
- Replace all TODO placeholders with template variables (__TITLE__,
__DESCRIPTION__, __READING_TIME__, __COVERED_VERSIONS_PROSE__)
- Remove the screenshot placeholder section (auto-generated posts have no
screenshot; the intro links to docs.sencho.io instead)
release-blog-scaffold.yml changes:
- Remove permission-pull-requests: write from app token (no PR created)
- Replace "Commit and open draft PR" step with a simple git commit + push to
sencho-website main. No duplicate-check step needed.
- Include src/data/blog/meta.ts in the git add so the Worker SEO mapping
stays in sync automatically.
* fix(ci): use escapeTsxString in updateMeta to handle backslashes in blog post title and description
CodeQL flagged two high-severity alerts: title and description written
into meta.ts via updateMeta were only single-quote-escaped, leaving
raw backslashes unescaped. A value containing a backslash followed by
a special character would produce a malformed escape sequence in the
generated TypeScript source. The escapeTsxString helper already handles
both cases; use it consistently instead of an open-coded replace.
Adds a workflow that fires on every v* tag push, computes the window
since the latest release post's anchor version in the sencho-website
repo, and (when the window reaches 5) opens a draft PR in
sencho-website with a fully pre-filled scaffold: grouped
ChangelogSection blocks parsed from CHANGELOG.md, version field set to
the new anchor, and a checklist body covering intro, screenshot, docs
link, and reading time. No auto-publish; the human writes the
narrative.
Uses the same sencho-token-app GitHub App as release-please, with its
installation extended to include sencho-website.
Anso