chore: simplify release workflow using changesets publish gating - #141
Merged
Conversation
Collapse the staging-branch publish path into main so version-package merges trigger npm staging and GitHub releases directly, matching the codex-usage pattern while keeping GPG-signed changesets and SBOM output. Co-authored-by: Cursor <cursoragent@cursor.com>
|
📝 WalkthroughWalkthroughThe release workflow is updated to trigger only on pushes to ChangesRelease Pipeline Consolidation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
commit: |
Run changesets in a lightweight version job and only build, SBOM, publish, and release when hasChangesets is false. Restore registry-url for npm OIDC provenance and add job timeouts. Co-authored-by: Cursor <cursoragent@cursor.com>
commit: |
Use pinned npm via setup-node instead of npm@latest, read package.json directly in shell steps to avoid template injection, and drop the redundant metadata step that triggered shellcheck SC2129. Co-authored-by: Cursor <cursoragent@cursor.com>
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 88-89: The release workflow currently interpolates step outputs
from the package step directly inside shell scripts, which is unsafe because the
values are expanded before Bash quoting applies. Move the package metadata from
steps.package.outputs.* into env variables for the affected shell blocks, then
reference those env vars at runtime with proper quoting. Update the shell steps
around the package handling logic in the release workflow, including the later
section that uses the same outputs, so all package_name/package_version usage
comes from env instead of direct expression interpolation.
- Around line 98-136: The preflight check in the release workflow is swallowing
failures from npm stage list by using a fallback that hides auth/permission
errors, which can cause the later npm stage publish path to fail unnecessarily.
Update the staged-package detection logic in the release job to handle npm stage
list errors explicitly using the existing
staged_json/package_name/package_version check, or bypass this preflight when
running in OIDC-only mode, so already-staged versions exit cleanly instead of
falling through.
In `@CONTRIBUTING.md`:
- Line 120: The release-flow description in CONTRIBUTING.md is missing the final
npm approval step after staging the publish. Update the text around the release
workflow to mention that after `release.yml` stages the npm publish with
provenance and creates the GitHub release, a maintainer must complete the npm
approval/2FA step before the package is publicly installable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 204acfb9-965e-4a02-be4f-d5aab22687ac
📒 Files selected for processing (2)
.github/workflows/release.ymlCONTRIBUTING.md
Fail fast on auth errors from npm stage list instead of swallowing them, and note the maintainer npm approval step in CONTRIBUTING. Co-authored-by: Cursor <cursoragent@cursor.com>
commit: |
This was referenced Jun 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
main(changesets only) /staging(publish + release) flow into a singlemain-triggered workflow, matching the pattern in codex-usageversion— lightweight changesets-only path (no build) when opening/updating the version packages PRpublish— build, SBOM, npm stage, and GitHub release only whenhasChangesets == 'false'npm stage publish . --provenanceharden-runner,commitMode: github-apifor GPG-signed version commits, CycloneDX SBOM on releases,registry-urlfor npm OIDC provenance, job timeoutsstagingbranch retirement inCONTRIBUTING.mdStaging / rulesets cleanup
refs/heads/main— no ruleset changes requiredstagingbranch is already deletedstagingandfix/release-staging-oidcTest plan
.github/workflows/release.ymlversionjob only;publishjob skipped)publishjob stages npm publish with provenance and creates GitHub release with SBOMNote
Simplify release workflow by splitting versioning and publish into separate gated jobs
releasejob in release.yml with two jobs:version(creates/updates a version packages PR via changesets) andpublish(builds, stages npm publish with provenance, and creates a GitHub release).publishjob is gated onhas_changesets == 'false', so it only runs after the version packages PR is merged.npm sbomto CycloneDX) and GitHub release creation (with changelog notes) are now part of thepublishjob unconditionally, without branch-conditional logic.mainonly.Macroscope summarized 0bd3478.