Release via tanem/release-action - #3605
Merged
Merged
Conversation
tanem
force-pushed
the
release-via-action
branch
from
August 8, 2026 04:12
16c2919 to
0b97b6c
Compare
Replaces the tanem-scripts release command with the composite action. The version bump still comes from the labels on PRs merged since the last tag; what changes is what produces it and what it writes. The workflow drops the RELEASE_TOKEN checkout credential: the action pushes the bump commit and tag with the ambient GITHUB_TOKEN. That only works because master's required status check has been removed — a GITHUB_TOKEN push cannot trigger workflows, so a bump commit can never earn a `ci` check of its own, and waiting for one would deadlock. setup-node loses registry-url, which trusted publishing makes redundant, and cache: 'npm', which the fleet workflow shape does not carry. The git-identity step goes too: the action sets github-actions[bot] itself. The `if: github.ref == 'refs/heads/master'` guard stays. The cron only fires on the default branch, but a manual dispatch can target any branch, and without the guard one of those would bump, tag and publish that branch to npm as latest. npm ci and npm test are load-bearing steps, not hygiene. This package has no prepublishOnly, so the dist/ that reaches the registry is the one npm test builds via its build step, and the tests gate the release exactly as they did under the old flow. CHANGELOG.md is closed at v19.1.2; GitHub Releases takes over, categorised by the same labels through .github/release.yml. AUTHORS is left in place but goes stale — nothing regenerates it now, and removing a contributor credit is a separate call. Regenerating the lockfile also corrects a stale packages[""].version it had been carrying.
tanem
force-pushed
the
release-via-action
branch
from
August 8, 2026 04:23
0b97b6c to
58165b9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves this repo's release off the
tanem-scriptsnpm package and onto thetanem/release-actioncomposite action, SHA-pinned to v0.1.0. The label-driven bump, the Monday cron and the OIDC provenance publish all carry over unchanged — what goes away is the devDependency, theRELEASE_TOKENPAT and the regeneratedCHANGELOG.md.The workflow keeps its filename, which is load-bearing: npm's trusted publisher for this package matches on repo plus workflow filename, so renaming it would need the publisher updated first.
npm ciandnpm testare equally load-bearing — this package has noprepublishOnly, so thedist/that reaches the registry is the onenpm testbuilds through itsbuildstep, and the tests gate the release exactly as they did before. Both were verified locally: a fullnpm testpasses and leaves the working tree clean, which matters becausenpm versionrefuses a dirty tree.The
if: github.ref == 'refs/heads/master'guard is kept deliberately.ci.ymlruns onv*as well asmaster, so breaking work can be staged on a long-lived version branch; the cron only ever fires on the default branch, but a manual dispatch can target any branch, and without the guard one of those would publish a half-finished major. The locked fleet workflow shape doesn't carry the guard, but it doesn't forbid a job condition either, and dropping it would have been a silent regression against the workflow this replaces.The push now uses the ambient
GITHUB_TOKENinstead ofRELEASE_TOKEN. That required removing master's requiredcistatus check, since a push made withGITHUB_TOKENdoes not trigger workflows and so a bump commit can never earn a check of its own. Force-push and deletion protection stay in place, and Renovate is unaffected — it reads branch status itself rather than relying on GitHub's native auto-merge.setup-nodealso losesregistry-url(redundant under trusted publishing) andcache: 'npm', and the git-identity step goes because the action setsgithub-actions[bot]itself.CHANGELOG.mdis closed at v19.1.2 with a pointer to GitHub Releases, which becomes the canonical changelog and is generated from the same labels via the new.github/release.yml.AUTHORSis left in place but is now stale: nothing regenerates it, and removing a contributor credit is a separate call.AGENTS.mdandMIGRATION.mdare updated to describe the flow that now exists.Regenerating the lockfile also corrects a stale
packages[""].versionit had been carrying — that is not a version bump. A local dry-run against this repo at the pinned action version reportsNothing to release: no merged pull requests since the last release, which is the correct skip for the current state of master.