ci: replace direct-push release with a PR-based release flow #74
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| #!/usr/bin/env node | ||
| /* global process, console */ | ||
| // Phase 1 of the PR-based release flow (task_1788457898992, Aaron ruling | ||
| // "pipeline: pr-flow"). Computes the next version + release notes via | ||
| // semantic-release's own Node API in --dry-run mode -- this is the safe, | ||
| // documented, side-effect-free primitive (no git write, no tag push, no npm | ||
| // publish, no GitHub release; verified this is a real behavioral guarantee | ||
| // of dry-run, not something this script has to enforce itself). Bumps | ||
| // package.json and CHANGELOG.md locally so the caller workflow can commit | ||
| // them to a PR branch instead of semantic-release's own @semantic-release/git | ||
| // pushing straight to protected main (GH006). | ||
| // | ||
| // Writes GITHUB_OUTPUT keys: release_needed, version. Notes are written to | ||
| // CHANGELOG.md directly (same as @semantic-release/changelog would) rather | ||
| // than passed through GITHUB_OUTPUT, since release notes can contain | ||
| // characters/length that don't survive that path cleanly. | ||
| import semanticRelease from "semantic-release"; | ||
| import { readFileSync, writeFileSync, appendFileSync } from "node:fs"; | ||
| import { execSync } from "node:child_process"; | ||
|
|
||
| const result = await semanticRelease({ dryRun: true, ci: false }); | ||
|
|
||
| const githubOutput = process.env.GITHUB_OUTPUT; | ||
| if (!result) { | ||
| console.log("No release needed."); | ||
| if (githubOutput) appendFileSync(githubOutput, "release_needed=false\n"); | ||
| process.exit(0); | ||
| } | ||
|
|
||
| const { version, notes } = result.nextRelease; | ||
| console.log(`Next release: ${version}`); | ||
|
|
||
| // Bump package.json without creating a git tag or committing -- pure file | ||
| // write, same command @semantic-release/npm uses internally for this step. | ||
| execSync(`npm version ${version} --no-git-tag-version --allow-same-version`, { | ||
| stdio: "inherit", | ||
| }); | ||
|
|
||
| // Prepend to CHANGELOG.md, matching @semantic-release/changelog's own | ||
| // convention (newest release on top) so this stays a drop-in for repos that | ||
| // already have history in this format. | ||
| const changelogPath = "CHANGELOG.md"; | ||
| let existing = ""; | ||
| try { | ||
| existing = readFileSync(changelogPath, "utf8"); | ||
| } catch { | ||
| // No CHANGELOG.md yet -- fine, this is the first entry. | ||
| } | ||
| writeFileSync(changelogPath, `${notes}\n\n${existing}`.trimEnd() + "\n"); | ||
|
|
||
| if (githubOutput) { | ||
| appendFileSync(githubOutput, "release_needed=true\n"); | ||
| appendFileSync(githubOutput, `version=${version}\n`); | ||
| } |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
Repository: WYRE-AI/node-halopsa
Length of output: 332
🏁 Script executed:
Repository: WYRE-AI/node-halopsa
Length of output: 12736
Sensitive Data Exposure (CWE-522): Insufficiently Protected Credentials
Reachability: External · Exploitability: Difficult
Restore a clean trust boundary before credentialed release commands.
A compromised dependency can modify project files or installed modules during
npm ci. Later credentialed npm and Node commands can then execute the modified code or use modified npm configuration to exfiltrateGITHUB_TOKENandNODE_AUTH_TOKEN.Run credentialed release operations in a fresh job or clean checkout. Install release dependencies with lifecycle scripts disabled, and generate npm authentication configuration outside the mutable workspace.
🤖 Prompt for AI Agents