chore(release): add CI release pipeline with npm provenance - #52
Conversation
Publish from GitHub Actions via npm trusted publishing (OIDC) instead of a developer machine, so every release carries a provenance attestation and no long-lived npm token is stored anywhere. Version bumps are derived from conventional commits by release-it. CHANGELOG.md stays hand-curated, because behavior changes and migration notes cannot be derived from commit subjects; a workflow guard refuses to publish a version that has no changelog entry.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. 📝 WalkthroughSummary by CodeRabbit
WalkthroughThe pull request adds a GitHub Actions release workflow for version tags and manual rehearsals. It configures release-it for npm provenance and Conventional Commits. It documents versioning, changelog, OIDC, validation, and publication procedures. Changesnpm release pipeline
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to The release workflow and supporting documentation are merge-ready after normal checks and review; no actionable merge-blocking risk remains. Possibly related PRs
Suggested labels: Suggested reviewers: Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error)
✅ Passed checks (5 passed)
Warning Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption. Comment |
|
React Doctor found 8 issues in 5 files · 2 errors & 6 warnings · score 64 / 100 (Needs work) · full project Errors
6 warnings
Reviewed by React Doctor for commit |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
85-106: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winHandle the "no releasable commits" case explicitly.
Silence is not a plan. If
release-ithas nothing to release, don't let the pipeline stumble into a confusing failure three steps later.
release-it --release-version"prints nothing and exits successfully" when there is no next version to release, per release-it's own documentation: Add the --release-version flag to print the next version without releasing anything. If no next version is available, it prints nothing and exits successfully. In that caseversion(Line 95) is empty,GITHUB_OUTPUTreceivesversion=(Line 97), and the CHANGELOG check (Lines 102-106) produces an unhelpfulCHANGELOG.md has no '## ' sectionerror instead of telling the operator that there's simply nothing to release.🛡️ Proposed fix to fail with a clear message
version="$(bunx release-it "${args[@]}")" + if [ -z "$version" ]; then + echo "::error::No releasable version was resolved (no conventional-commit bump since the last tag)." + exit 1 + fi echo "Resolved version: $version" echo "version=$version" >> "$GITHUB_OUTPUT"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 85 - 106, Update the Resolve target version step around the version assignment and GITHUB_OUTPUT write to detect an empty release-it result and exit immediately with a clear “no releasable commits” message. Only write the version output when a non-empty version is returned, leaving the existing CHANGELOG verification unchanged for valid releases.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 49-56: Remove the registry-url input from the Setup Node.js step
in the OIDC release job. Keep node-version 24 unchanged, and rely on the
registry configuration already defined in package/package.json so setup-node
does not generate an _authToken entry or placeholder NODE_AUTH_TOKEN before
publishing.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 85-106: Update the Resolve target version step around the version
assignment and GITHUB_OUTPUT write to detect an empty release-it result and exit
immediately with a clear “no releasable commits” message. Only write the version
output when a non-empty version is returned, leaving the existing CHANGELOG
verification unchanged for valid releases.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 0a73fa7b-a607-45a0-88f4-4eb1936028da
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (6)
.github/workflows/release.ymlCHANGELOG.mdCONTRIBUTING.mdRELEASING.mdpackage/.release-it.jsonpackage/package.json
`main` enforces pull request reviews with `enforce_admins` enabled, so the previous design could not have worked: github-actions[bot] cannot push a release commit, and the failing push would have run after `npm publish` had already succeeded, leaving a published version with no tag or release. Publishing is now triggered by pushing a version tag. The version bump lands through a normal reviewed pull request, and CI never writes to git. It verifies the tag matches package.json, that a changelog section exists, and that the version is not already on npm, then publishes and creates the release. Also drops registry-url from setup-node: it writes an _authToken entry into .npmrc, which makes npm assume classic token auth and skip the OIDC flow.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 117-130: Update the Publish step’s release arguments to ensure
prerelease versions are not published under npm’s latest dist-tag. In the
release flow around the args array and package/.release-it.json configuration,
supply a non-latest tag such as next when publishing prereleases, or explicitly
reject prerelease tags; preserve the existing dry-run behavior for non-push
events.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 28b7ebcc-b074-4f5e-b0fc-aebc2c6f2129
📒 Files selected for processing (3)
.github/workflows/release.ymlRELEASING.mdpackage/.release-it.json
💤 Files with no reviewable changes (1)
- package/.release-it.json
Tagging a prerelease version publishes under a matching dist-tag instead of latest, and marks the GitHub Release as a pre-release. release-it derives both from the version, so no extra configuration is needed - verified with a dry run against 1.1.0-rc.1, which resolved to `npm publish --tag rc`.
Stale: finding acknowledged as invalid; thread resolved.
2 participants
Summary
Moves publishing off developer machines and into CI, so releases are reproducible
and carry an npm provenance attestation.
1.0.0was published locally and hasattestations: Noneon the registry.Also adds
CHANGELOG.md, seeded with1.0.0and the notes for the upcoming1.1.0.What changed
.github/workflows/release.yml—workflow_dispatchrelease with anincrementinput (autoderives the bump from conventional commits) and adry_runtoggle that defaults to on. Runs the same gate as CI, then publisheswith
--provenanceusing npm trusted publishing (OIDC,id-token: write).package/.release-it.json— adds@release-it/conventional-changelogforbump inference and generated GitHub Release notes.
npm.skipChecks: trueisrequired because release-it otherwise runs
npm whoamiat startup, which failsunder trusted publishing where the token is only minted at publish time.
CHANGELOG.md— hand-curated, with a prominent Behavior changessection for
1.1.0(see below).RELEASING.md— the process, plus the one-time npm and branch-protection setup.Why the changelog is not generated
Two changes in
1.1.0alter runtime behavior without changing any typesignatures, so consumer code keeps compiling but behaves differently:
onRegionChange/onRegionChangeCompletenow fire once per gesture insteadof continuously, and no longer fire for programmatic camera updates (feat: enhance map region change handling and improve camera update logic #48)
MapViewRef.setCamera/animateCamera/fitToCoordinatesnow returnPromise<void>(fix(ios): remove main.sync from HybridMapView and async camera APIs #45)Neither is derivable from commit subjects. Related:
Fix threading issues on ios(#43) is not a conventional commit, so it is absent from the auto-generated notes
entirely — verified by running
release-it --changelog. The workflow fails ifCHANGELOG.mdhas no section for the version being released.Verification
release-it --release-versionresolves1.1.0from the commits sincev1.0.0actionlintclean on all workflows1.1.01does not false-match
1.1.011.5.1boundaryBefore the first CI release
Trusted publishing must be configured on npmjs.com for this package
(repo
gmi-software/react-native-better-maps, workflowrelease.yml), andgithub-actions[bot]needs to be able to push the release commit and tag tomain. Both are documented inRELEASING.md.Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.