mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-08 09:54:26 +00:00
Anso
da94599411
release-please stores the release notes in the Release PR body when it opens that PR, and builds the GitHub Release from that stored body at merge time. The contributor credit step runs afterwards and only rewrites CHANGELOG.md on the branch, so credits reached the changelog but never the published notes. Everything that reads release bodies, including the releases page and the website changelog, showed uncredited text. Add a step that re-publishes the notes from CHANGELOG.md after a release is created. The two are otherwise byte-identical, so the edit is a no-op when there is nothing to credit. It runs before the credit step on purpose: a single run can both publish a release and open the next Release PR, and the credit step checks out that new branch, which would leave the wrong CHANGELOG.md in the working tree.
101 lines
4.4 KiB
YAML
101 lines
4.4 KiB
YAML
name: Release Please
|
|
|
|
concurrency:
|
|
group: release-please-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
# Manual recovery lever for cases where the action fails on a transient
|
|
# GitHub API issue (e.g. duplicate-release-tag during a retry) and exits
|
|
# before scanning main for new conventional commits. Re-running from the
|
|
# Actions tab requeues the same logic against the current main HEAD; no
|
|
# code push needed. Triggering manually does NOT skip the action's own
|
|
# state checks, so it cannot accidentally double-publish a release.
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
release-please:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Mint a short-lived installation token for the `sencho-token-app`
|
|
# GitHub App instead of using a long-lived user PAT. The token:
|
|
# - is scoped to this one repository (least privilege)
|
|
# - requests only the permissions release-please actually needs
|
|
# - is auto-revoked by the action's post step at job end
|
|
# - unlike GITHUB_TOKEN, CAN trigger downstream workflow runs, so the
|
|
# tag push from release-please still cascades to docker-publish.yml
|
|
- name: Generate GitHub App installation token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
app-id: ${{ secrets.APP_ID }}
|
|
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
|
owner: ${{ github.repository_owner }}
|
|
repositories: Sencho
|
|
permission-contents: write
|
|
permission-pull-requests: write
|
|
permission-issues: read
|
|
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
token: ${{ steps.app-token.outputs.token }}
|
|
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
|
|
with:
|
|
node-version-file: '.node-version'
|
|
|
|
- id: release
|
|
uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
|
|
with:
|
|
token: ${{ steps.app-token.outputs.token }}
|
|
config-file: release-please-config.json
|
|
manifest-file: .release-please-manifest.json
|
|
|
|
# release-please stores the release notes in the release PR body when it
|
|
# opens that PR, and builds the GitHub Release from that stored body at
|
|
# merge time. The credit step below runs afterwards and only rewrites
|
|
# CHANGELOG.md on the branch, so credits never reach the published notes.
|
|
# Re-publish them from CHANGELOG.md, which by now carries the credits.
|
|
# Runs before the credit step, which checks out the next release branch
|
|
# and would otherwise leave the wrong CHANGELOG.md in the working tree.
|
|
- name: Sync published release notes with credited changelog
|
|
if: ${{ steps.release.outputs.releases_created == 'true' }}
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
run: |
|
|
TAG="$(node scripts/release-notes-from-changelog.mjs "$RUNNER_TEMP/release-notes.md")"
|
|
gh release edit "$TAG" --notes-file "$RUNNER_TEMP/release-notes.md"
|
|
|
|
- name: Credit external contributors in changelog
|
|
if: ${{ steps.release.outputs.prs_created == 'true' }}
|
|
env:
|
|
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
GITHUB_REPOSITORY: ${{ github.repository }}
|
|
# fromJSON must tolerate empty pr: env is evaluated even when if: skips
|
|
# (publish runs leave pr unset). Empty object yields empty RELEASE_BRANCH.
|
|
RELEASE_BRANCH: ${{ fromJSON(steps.release.outputs.pr || '{}').headBranchName || '' }}
|
|
MAINTAINER_LOGINS: ""
|
|
run: |
|
|
if [ -z "$RELEASE_BRANCH" ]; then
|
|
echo "RELEASE_BRANCH is empty; aborting."
|
|
exit 1
|
|
fi
|
|
cp scripts/credit-changelog-contributors.mjs "$RUNNER_TEMP/"
|
|
git fetch origin "$RELEASE_BRANCH"
|
|
git checkout "$RELEASE_BRANCH"
|
|
node "$RUNNER_TEMP/credit-changelog-contributors.mjs"
|
|
if [ -n "$(git status --porcelain CHANGELOG.md)" ]; then
|
|
git config user.name "sencho-quartermaster[bot]"
|
|
git config user.email "275163604+sencho-quartermaster[bot]@users.noreply.github.com"
|
|
git add CHANGELOG.md
|
|
git commit -m "chore: credit external contributors in changelog"
|
|
git push origin "HEAD:$RELEASE_BRANCH"
|
|
fi
|