ci: release on every push to main, via semantic-release #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| # Every push to main releases, if the commits since the last tag warrant one. | |
| # No release PR, no approval step: semantic-release reads the conventional | |
| # commits, works out the next version, tags it, writes the GitHub release notes | |
| # and publishes to GitHub Packages in a single run. | |
| # | |
| # A push with nothing releasable in it (docs:, chore:, ci:) is a no-op. That is | |
| # the behaviour to expect rather than a failure — see .releaserc.json for which | |
| # commit types earn which bump. | |
| # | |
| # WHAT THIS DELIBERATELY DOES NOT DO: write anything back to main. The usual | |
| # semantic-release setup adds @semantic-release/changelog and | |
| # @semantic-release/git so the version bump and CHANGELOG land as a commit on | |
| # the release branch. Both are omitted here, because main requires pull requests | |
| # and a bot pushing straight to it would either be blocked or need a bypass | |
| # nobody should hand a CI job. The consequences, both fine: | |
| # | |
| # * package.json's version in the repo is a placeholder. Git tags are the | |
| # source of truth for what exists; semantic-release writes the real version | |
| # into package.json in the runner just before publishing, and never commits | |
| # it. Do not bump it by hand — nothing reads it. | |
| # * There is no CHANGELOG.md. The GitHub release notes are the changelog, and | |
| # they are generated from the same commits. | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: release | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write # create tags and releases | |
| packages: write # publish to npm.pkg.github.com | |
| issues: write # semantic-release/github verifies these even with | |
| pull-requests: write # comments switched off | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # fetch-depth: 0 is required, not tidiness — semantic-release works out | |
| # the next version by reading every commit since the last tag, and a | |
| # shallow clone has neither the tags nor the history to do it. | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.14 | |
| # Writes the .npmrc that the publish reads, scoped to this org and | |
| # pointed at GitHub Packages. semantic-release itself runs on Node. | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22 | |
| registry-url: https://npm.pkg.github.com | |
| scope: "@engineio" | |
| - run: bun install --frozen-lockfile | |
| # Gate the release on the same checks CI runs. A broken build must not | |
| # become a published version — once a version exists on the registry it | |
| # cannot be replaced, only superseded. | |
| - name: Verify before releasing | |
| run: | | |
| bun run check | |
| bun run build | |
| - name: Release | |
| run: bunx semantic-release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |