ci: replace semantic-release with manual tag-based release

Author: hsluoyz

.github/workflows/main.yml

@@ -27,16 +27,3 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           flags: node-${{ matrix.node-version }}
           fail_ci_if_error: false
-
-  semantic-release:
-    needs: [test]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Run semantic-release
-        if: github.repository == 'apache/casbin-node-casbin' && github.event_name == 'push'
-        run: yarn install && yarn semantic-release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,106 @@
+name: release
+
+# Releases are cut manually by pushing a git tag (Apache requires a release vote,
+# so nothing is ever published automatically from a commit or a merged PR).
+#
+#   v5.44.0-rc1  -> GitHub *pre-release* (the candidate the release manager votes on)
+#   v5.44.0      -> GitHub release + publish to npm
+#
+# Both cases attach an Apache-style source release tarball plus its SHA-512
+# checksum. The release manager downloads the tarball, signs it locally with
+# their own GPG key, and uses that for the vote.
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+env:
+  # Base name of the Apache source release artifact.
+  ARTIFACT_PREFIX: apache-casbin-node-casbin
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    outputs:
+      prerelease: ${{ steps.meta.outputs.prerelease }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Resolve release metadata
+        id: meta
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF_NAME}"
+          VERSION="${TAG#v}"
+
+          # A candidate tag (v5.44.0-rc1) is a pre-release; the artifact inside it is
+          # still named after the final version so it can be promoted unchanged.
+          if [[ "$VERSION" == *-rc* ]]; then
+            PRERELEASE=true
+          else
+            PRERELEASE=false
+          fi
+          BASE_VERSION="${VERSION%%-rc*}"
+
+          PKG_VERSION="$(node -p "require('./package.json').version")"
+          if [[ "$BASE_VERSION" != "$PKG_VERSION" ]]; then
+            echo "::error::Tag $TAG implies version $BASE_VERSION but package.json says $PKG_VERSION"
+            exit 1
+          fi
+
+          {
+            echo "tag=$TAG"
+            echo "version=$VERSION"
+            echo "base_version=$BASE_VERSION"
+            echo "prerelease=$PRERELEASE"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Build source release tarball
+        id: src
+        run: |
+          set -euo pipefail
+          BASE_VERSION="${{ steps.meta.outputs.base_version }}"
+          NAME="${ARTIFACT_PREFIX}-${BASE_VERSION}-incubating-src"
+
+          git archive --format=tar.gz --prefix="${NAME}/" -o "${NAME}.tar.gz" "${{ steps.meta.outputs.tag }}"
+          sha512sum "${NAME}.tar.gz" > "${NAME}.tar.gz.sha512"
+
+          echo "name=$NAME" >> "$GITHUB_OUTPUT"
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          NAME="${{ steps.src.outputs.name }}"
+          ARGS=(--title "${{ steps.meta.outputs.tag }}" --generate-notes)
+          if [[ "${{ steps.meta.outputs.prerelease }}" == "true" ]]; then
+            ARGS+=(--prerelease)
+          fi
+          gh release create "${{ steps.meta.outputs.tag }}" "${ARGS[@]}" \
+            "${NAME}.tar.gz" "${NAME}.tar.gz.sha512"
+
+  publish:
+    # Only a final tag (no -rc) goes to the package registry.
+    needs: [release]
+    if: needs.release.outputs.prerelease == 'false'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: yarn install
+
+      # `prepack` runs lint + test + build, so the published tarball is built here.
+      - run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.releaserc.json

@@ -22,16 +22,11 @@
     "test": "jest",
     "lint": "eslint . --ext .js,.ts",
     "fmt": "eslint . --ext .js,.ts --fix",
-    "semantic-release": "semantic-release",
     "commit": "git-cz",
     "clean": "rimraf lib",
     "coverage": "jest --coverage"
   },
   "devDependencies": {
-    "@semantic-release/commit-analyzer": "^8.0.1",
-    "@semantic-release/github": "^7.2.3",
-    "@semantic-release/npm": "^7.1.3",
-    "@semantic-release/release-notes-generator": "^9.0.3",
     "@types/jest": "^26.0.20",
     "@types/node": "^10.5.3",
     "@types/picomatch": "^2.2.2",
@@ -48,7 +43,6 @@
     "prettier": "^2.2.1",
     "pretty-quick": "^3.1.0",
     "rimraf": "^3.0.2",
-    "semantic-release": "^17.4.4",
     "ts-jest": "^26.5.3",
     "tslint": "^5.11.0",
     "tsup": "^8.5.1",

package.json

@@ -294,11 +294,43 @@ export class Enforcer extends ManagementEnforcer {
    * getPermissionsForUser gets permissions for a user or role.
    *
    * @param user the user.
+   * @param domain the domain, optional. When given, only the permissions of that domain are returned.
    * @return the permissions, a permission is usually like (obj, act). It is actually the rule without the subject.
    */
-  public async getPermissionsForUser(user: string): Promise<string[][]> {
-    const subIndex = this.getFieldIndex('p', FieldIndex.Subject);
-    return this.getFilteredPolicy(subIndex, user);
+  public async getPermissionsForUser(user: string, ...domain: string[]): Promise<string[][]> {
+    return this.getNamedPermissionsForUser('p', user, ...domain);
+  }
+
+  /**
+   * getNamedPermissionsForUser gets permissions for a user or role by the named policy.
+   *
+   * @param ptype the policy type, can be "p", "p2", "p3", ..
+   * @param user the user.
+   * @param domain the domain, optional. When given, only the permissions of that domain are returned.
+   * @return the permissions, a permission is usually like (obj, act). It is actually the rule without the subject.
+   */
+  public async getNamedPermissionsForUser(ptype: string, user: string, ...domain: string[]): Promise<string[][]> {
+    const subIndex = this.getFieldIndex(ptype, FieldIndex.Subject);
+    if (subIndex === -1) {
+      return [];
+    }
+    if (domain.length === 0) {
+      return this.getFilteredNamedPolicy(ptype, subIndex, user);
+    }
+
+    // The domain is not necessarily the token right after the subject, so it has to be
+    // looked up in the model instead of being assumed to sit at a fixed index.
+    const domIndex = this.getFieldIndex(ptype, FieldIndex.Domain);
+    if (domIndex === -1) {
+      return this.getFilteredNamedPolicy(ptype, subIndex, user);
+    }
+
+    const start = Math.min(subIndex, domIndex);
+    // "" means not to match that field.
+    const fieldValues = new Array<string>(Math.abs(subIndex - domIndex) + 1).fill('');
+    fieldValues[subIndex - start] = user;
+    fieldValues[domIndex - start] = domain[0];
+    return this.getFilteredNamedPolicy(ptype, start, ...fieldValues);
   }
 
   /**
@@ -357,16 +389,10 @@ export class Enforcer extends ManagementEnforcer {
     const roles = await this.getImplicitRolesForUser(user, ...domain);
     roles.unshift(user);
     const res: string[][] = [];
-    const withDomain = domain && domain.length !== 0;
 
     for (const n of roles) {
-      if (withDomain) {
-        const p = await this.getFilteredPolicy(0, n, ...domain);
-        res.push(...p);
-      } else {
-        const p = await this.getPermissionsForUser(n);
-        res.push(...p);
-      }
+      const p = await this.getPermissionsForUser(n, ...domain);
+      res.push(...p);
     }
 
     return res;