chore: new release processes - #899
joaodordio wants to merge 4 commits into
Conversation
Replaces the existing ad-hoc release workflows with a two-step process: - Prepare Release: bumps version, updates changelog, opens PR, creates GitHub draft release - Publish Release: promotes draft, tags main, publishes to npm, posts Slack Ref: SDK release process team agreement 2026-09-11
|
|
Coverage Impact This PR will not change total coverage. 🚦 See full report on Qlty Cloud »🛟 Help
|
|
This PR vs Changelog Check is failing. What the code does What the spec/rule says Why it conflicts Suggested action Satisfy Changelog Check before merge. |
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Verify release is ready | ||
| run: | | ||
| if ! grep -qF "## $VERSION" CHANGELOG.md; then | ||
| echo "::error::CHANGELOG.md has no entry for $VERSION. Merge the prepare-release PR to master before running this workflow." | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
Publish does not constrain git to master, so it neither verifies merge nor tags master.
This comment also includes lines 50 -> 57
What the code does
actions/checkout@v4 has no ref. The “merged” check is grep -qF "## $VERSION" CHANGELOG.md on whatever ref the operator picked in “Use workflow from”. The tag is created with --target "$(git rev-parse HEAD)". The step is still named “tag main”.
What the spec says
“Verifies the prepare-release PR has been merged (checks CHANGELOG on master)” and “Publishes the draft release and creates the tag on master at this moment.”
Why it conflicts
workflow_dispatch checks out the selected branch, not the default branch. The unmerged prepare branch already contains## $version, so the grep passes without a merge. grep -qF "## 3.1.0" also matches a historical ## 3.1.0 or a prefix of ## 3.1.0-rc.1. If gh release create --draft already created a tag at prepare time, GitHub’s target_commitish is unused once the tag exists, so publish may not retarget.
Suggested action
Make publish (and prepare) operate on master only, and make the merge/version/tag gate actually prove “this version is on master at HEAD” before tagging.
| - uses: actions/checkout@v4 | ||
| with: | ||
| token: ${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
Prepare has the same unpinned checkout.
What the code does
Checkout uses the dispatch ref; create-pull-request commits that working tree onto release/SDK-….
What the spec says
Prepare is the first step of a master-based release; publish then tags master.
Why it conflicts
Running Prepare from a feature branch opens a PR whose contents are that branch plus the bump, not “master + version bump”.
Suggested action
Pin Prepare to master (or otherwise guarantee the PR base and file contents are default-branch HEAD).
… grep
- Add ref: master/main to actions/checkout in all prepare/publish workflows
so workflows always operate on the default branch regardless of dispatch ref
- Replace shell-injection-prone ${{ steps...outputs.notes }} pattern with
--notes-file using $RUNNER_TEMP/release-notes.md (safe from backticks/quotes
in changelog content)
- Treat empty [Unreleased] section as a hard error in prepare-release
- Fix CHANGELOG verification grep: grep -qE "^## \[VERSION\]" (anchored,
prevents substring matches and prefix collisions like 3.1.0 vs 3.1.0-rc1)
Replace SDK_RELEASE_TOKEN (iOS) and GITHUB_TOKEN (all repos) with a short-lived installation token from the iterable-sdk-release GitHub App, generated via actions/create-github-app-token@v1. Benefits: - App token triggers CI on PRs it creates (GITHUB_TOKEN cannot) - 1h TTL vs long-lived PAT - Workflow-scoped permissions so we can push .github/workflows/ files Required credentials (repo variable + secret, or set at org level): vars.ITERABLE_SDK_RELEASE_APP_ID secrets.ITERABLE_SDK_RELEASE_APP_PRIVATE_KEY
2 participants
Summary
Replaces the existing ad-hoc release workflows with a standardized two-step process.
No customer facing changes
Workflow 1: Prepare Release (
workflow_dispatch)Inputs:
version,ticketpackage.json+ regeneratessrc/itblBuildInfo.tsviascripts/autoCreatePackageInfo.jsWorkflow 2: Publish Release (
workflow_dispatch)Input:
version@iterable/react-native-sdk) via OIDC trusted publishing#eng-sdk-teamon SlackFiles changed
.github/workflows/prepare-release.yml.github/workflows/publish-release.ymlSecrets to add
SLACK_WEBHOOKmust be configured in repo Settings > Secrets > Actions before the first Publish Release run.No customer facing changes