From 1db1774e8c0f602d1c94c09e4bad0eed3b083b7a Mon Sep 17 00:00:00 2001 From: Josh Owens Date: Fri, 21 Aug 2026 17:39:34 -0400 Subject: [PATCH 1/2] =?UTF-8?q?ci:=20semantic-release=20on=20merge=20to=20?= =?UTF-8?q?main=20=E2=80=94=20auto=20version,=20tag,=20npm=20publish,=20Gi?= =?UTF-8?q?tHub=20release?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirrors the-ai-team-plugin release setup (semantic-release on main push, manual v* tag fallback, workflow_dispatch), adapted for an npm package: @semantic-release/npm publishes with provenance, @semantic-release/git commits the version bump back to package.json. Commitlint enforces the conventional-commit types that drive version selection. Requires an NPM_TOKEN repo secret (automation token). Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GtAjJabU9hUkrzoWF3Xtzm --- .commitlintrc.yml | 12 ++++++ .github/workflows/commitlint.yml | 21 +++++++++++ .github/workflows/release.yml | 63 ++++++++++++++++++++++++++++++++ .releaserc.json | 21 +++++++++++ 4 files changed, 117 insertions(+) create mode 100644 .commitlintrc.yml create mode 100644 .github/workflows/commitlint.yml create mode 100644 .github/workflows/release.yml create mode 100644 .releaserc.json diff --git a/.commitlintrc.yml b/.commitlintrc.yml new file mode 100644 index 0000000..092c091 --- /dev/null +++ b/.commitlintrc.yml @@ -0,0 +1,12 @@ +# Conventional Commits — enforced on PRs via CI +# https://www.conventionalcommits.org/ +rules: + type-enum: + - 2 + - always + - [feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert] + type-case: [2, always, lower-case] + type-empty: [2, never] + subject-empty: [2, never] + subject-full-stop: [2, never, "."] + header-max-length: [2, always, 100] diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml new file mode 100644 index 0000000..fa2e0fe --- /dev/null +++ b/.github/workflows/commitlint.yml @@ -0,0 +1,21 @@ +name: Commitlint + +on: + pull_request: + branches: [main] + +permissions: + contents: read + +jobs: + commitlint: + name: Validate Commit Messages + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: wagoid/commitlint-github-action@v6 + with: + configFile: .commitlintrc.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..3059d26 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,63 @@ +name: Release + +on: + push: + branches: [main] # semantic-release determines if a new version is needed + tags: ["v*"] # manual tag fallback + workflow_dispatch: # manual trigger for re-runs + +permissions: + contents: write + issues: write + pull-requests: write + id-token: write # npm provenance + +jobs: + # ── Semantic Release ──────────────────────────────────────────────── + # Analyzes conventional commits since the last tag, determines the next + # version, publishes to npm, and creates a GitHub Release + git tag. + # Manual tag pushes and workflow_dispatch re-run publish for an existing + # version via the same action (semantic-release is idempotent: no new + # release-worthy commits → no release). + release: + name: Semantic Release + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + persist-credentials: true + + - uses: oven-sh/setup-bun@v2 + with: + bun-version: latest + + - uses: actions/setup-node@v4 + with: + node-version: "lts/*" + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Test + run: bun run test -- --run + + - name: Build + run: bun run build + + - uses: cycjimmy/semantic-release-action@v4 + id: release + with: + extra_plugins: | + @semantic-release/commit-analyzer + @semantic-release/release-notes-generator + @semantic-release/npm + @semantic-release/github + @semantic-release/git + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + + - name: Release result + if: steps.release.outputs.new_release_published == 'true' + run: echo "Released v${{ steps.release.outputs.new_release_version }} to npm" diff --git a/.releaserc.json b/.releaserc.json new file mode 100644 index 0000000..bee79a1 --- /dev/null +++ b/.releaserc.json @@ -0,0 +1,21 @@ +{ + "branches": ["main"], + "plugins": [ + "@semantic-release/commit-analyzer", + "@semantic-release/release-notes-generator", + [ + "@semantic-release/npm", + { + "npmPublish": true + } + ], + "@semantic-release/github", + [ + "@semantic-release/git", + { + "assets": ["package.json"], + "message": "chore(release): ${nextRelease.version} [skip ci]" + } + ] + ] +} From 75517bd33a739b98f6135f5a7a06ca072e56af31 Mon Sep 17 00:00:00 2001 From: Josh Owens Date: Fri, 21 Aug 2026 18:12:22 -0400 Subject: [PATCH 2/2] =?UTF-8?q?ci:=20address=20CodeRabbit=20review=20?= =?UTF-8?q?=E2=80=94=20drop=20dead=20tag=20trigger,=20pin=20actions=20to?= =?UTF-8?q?=20SHAs,=20pin=20bun?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The v* tag trigger was a fallback in name only: semantic-release is configured for main, so a tag-ref run exits without publishing. Removed. All six action references pinned to reviewed commit SHAs (this workflow holds NPM_TOKEN and write permissions). Bun pinned to 1.3.11 to match ci.yml. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GtAjJabU9hUkrzoWF3Xtzm --- .github/workflows/commitlint.yml | 4 ++-- .github/workflows/release.yml | 17 +++++++---------- 2 files changed, 9 insertions(+), 12 deletions(-) diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index fa2e0fe..17ee2b0 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -12,10 +12,10 @@ jobs: name: Validate Commit Messages runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 - - uses: wagoid/commitlint-github-action@v6 + - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6 with: configFile: .commitlintrc.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3059d26..7018ac0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,8 +3,7 @@ name: Release on: push: branches: [main] # semantic-release determines if a new version is needed - tags: ["v*"] # manual tag fallback - workflow_dispatch: # manual trigger for re-runs + workflow_dispatch: # manual re-run (only releases if new commits warrant it) permissions: contents: write @@ -16,23 +15,21 @@ jobs: # ── Semantic Release ──────────────────────────────────────────────── # Analyzes conventional commits since the last tag, determines the next # version, publishes to npm, and creates a GitHub Release + git tag. - # Manual tag pushes and workflow_dispatch re-run publish for an existing - # version via the same action (semantic-release is idempotent: no new - # release-worthy commits → no release). + # No release-worthy commits → no release (idempotent). release: name: Semantic Release runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 persist-credentials: true - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: - bun-version: latest + bun-version: "1.3.11" - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: "lts/*" @@ -45,7 +42,7 @@ jobs: - name: Build run: bun run build - - uses: cycjimmy/semantic-release-action@v4 + - uses: cycjimmy/semantic-release-action@16ca923e6ccbb50770c415a0ccd43709a8c5f7a4 # v4.2.2 id: release with: extra_plugins: |