From 3630e142f923c985bf77dda23944e6f8844c8e08 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20Devos?= Date: Mon, 5 Oct 2026 12:11:40 +0200 Subject: [PATCH] ci: migrate releases to release-please The release job pushed version bump commits directly to main, which the PCIDSS branch protection ruleset only allows through a bypass. release-please opens a release PR instead, so version bumps go through review and CodeQL like any other change. Merging the release PR creates the tag that triggers the existing npm publish workflow. --- .github/workflows/on-push-main.yaml | 29 +++-- .github/workflows/release-manager.yaml | 162 ------------------------- .release-please-manifest.json | 3 + release-please-config.json | 9 ++ 4 files changed, 28 insertions(+), 175 deletions(-) delete mode 100644 .github/workflows/release-manager.yaml create mode 100644 .release-please-manifest.json create mode 100644 release-please-config.json diff --git a/.github/workflows/on-push-main.yaml b/.github/workflows/on-push-main.yaml index a0301cf..feb648a 100644 --- a/.github/workflows/on-push-main.yaml +++ b/.github/workflows/on-push-main.yaml @@ -1,22 +1,25 @@ name: ON | PUSH | MAIN -run-name: CREATE RELEASE | MAIN +run-name: RELEASE PLEASE | MAIN -# When pushing to main, run the following jobs: -# - Call the release-manager to create a release +# When pushing to main, release-please opens or updates the release PR. +# Merging the release PR creates the vX.Y.Z tag and GitHub release, +# which triggers on-push-tag-release.yaml to publish to npm. +# The org token is required: tags and PRs created with GITHUB_TOKEN +# do not trigger other workflows (npm publish, CodeQL, lints). on: push: branches: - main +permissions: + contents: 'read' + jobs: - release-manager: - permissions: - contents: 'write' - id-token: 'write' - uses: ./.github/workflows/release-manager.yaml - with: - version-file: package.json - version-path: version - secrets: - GITHUB_ACCESS_TOKEN: ${{ secrets.USP_GITHUB_ADMIN_FINE_GRAINED_ACCES_TOKEN }} + release-please: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: googleapis/release-please-action@v5 + with: + token: ${{ secrets.USP_GITHUB_ADMIN_FINE_GRAINED_ACCES_TOKEN }} diff --git a/.github/workflows/release-manager.yaml b/.github/workflows/release-manager.yaml deleted file mode 100644 index c17b6f0..0000000 --- a/.github/workflows/release-manager.yaml +++ /dev/null @@ -1,162 +0,0 @@ -name: Release Manager - -### -### Release Manager -### - -on: - workflow_call: - inputs: - tag-prefix: - description: 'Tag prefix of the releases tags' - required: false - default: 'v' - type: string - output-file: - description: 'Output file for CHANGELOG modifications' - required: false - default: 'CHANGELOG.md' - type: string - version-file: - description: 'The file containing the version number' - required: false - default: 'config.json' - type: string - version-path: - description: 'The path to the version number in the file' - required: false - default: 'version' - type: string - release-count: - description: 'The number of releases to keep' - required: false - default: 0 - type: number - skip-on-empty: - description: 'Skip the release if there are no changes' - required: false - default: true - type: boolean - skip-commit: - description: 'Skip the commit of the version file' - required: false - default: false - type: boolean - skip-version-file: - description: 'Skip the version file update' - required: false - default: false - type: boolean - skip-ci: - description: 'Skip CI (CHANGELOG generation, bump version)' - required: false - default: false - type: boolean - pre-commit: - description: 'The pre-commit command to run' - required: false - default: '' - type: string - git-user-name: - description: 'Git user name used for push modifications (changelog, bump version' - required: false - default: 'Conventional Changelog' - type: string - git-path: - description: "Path filter for the logs. If set, only commits that match the path filter will be considered. By default, we won't use this feature(empty string)" - required: false - type: string - default: '' - git-user-email: - description: 'Git user email for pushed modifications (changelog, bump version)' - required: false - default: 'github@upstreampay.com' - type: string - git-message: - description: 'Git message used for commit modifications (changelog, bump version)' - required: false - default: 'chore(release): {version}' - type: string - preset: - description: 'Preset used for analyze commit from previous tag version' - required: false - default: 'angular' - type: string - pre-release: - description: 'Marks the release as pre-release' - required: false - default: false - type: boolean - secrets: - GITHUB_ACCESS_TOKEN: - description: 'Github access token which will be used for checkout project, create tag and push modifications (changelog, version bump)' - required: true - outputs: - release-url: - value: ${{ jobs.create_release.outputs.release_url }} - changelog: - value: ${{ jobs.create_release.outputs.changelog }} - clean-changelog: - value: ${{ jobs.create_release.outputs.clean_changelog }} - version: - value: ${{ jobs.create_release.outputs.version }} - tag: - value: ${{ jobs.create_release.outputs.tag }} - skipped: - value: ${{ jobs.create_release.outputs.skipped }} - -jobs: - create_release: - permissions: - contents: 'write' - id-token: 'write' - runs-on: ubuntu-latest - timeout-minutes: 30 - if: ${{ github.actor != 'DaGoodBoiii' }} - outputs: - release_url: ${{ steps.create_release.outputs.url }} - changelog: ${{ steps.conventional_changelog.outputs.changelog }} - clean_changelog: ${{ steps.conventional_changelog.outputs.clean_changelog }} - version: ${{ steps.conventional_changelog.outputs.version }} - tag: ${{ steps.conventional_changelog.outputs.tag }} - skipped: ${{ steps.conventional_changelog.outputs.skipped }} - steps: - # Checkout repository with CI user token in order to push on protected branch in the next step if needed - - uses: actions/checkout@v4 - with: - token: ${{ secrets.GITHUB_ACCESS_TOKEN }} - fetch-depth: 0 - - # Generate new version of the release, create tag and release associated - # If there is no changes (fix or feat), release creation will be skipped - - name: Conventional Changelog Action - id: conventional_changelog - uses: TriPSs/conventional-changelog-action@v3 - with: - github-token: ${{ secrets.GITHUB_ACCESS_TOKEN }} - git-message: ${{ inputs.git-message }} - git-user-name: ${{ inputs.git-user-name }} - git-user-email: ${{ inputs.git-user-email }} - git-path: ${{ inputs.git-path }} - preset: ${{ inputs.preset }} - tag-prefix: ${{ inputs.tag-prefix }} - output-file: ${{ inputs.output-file }} - release-count: ${{ inputs.release-count }} - version-file: ${{ inputs.version-file }} - version-path: ${{ inputs.version-path }} - skip-on-empty: ${{ inputs.skip-on-empty }} - skip-commit: ${{ inputs.skip-commit }} - skip-version-file: ${{ inputs.skip-version-file }} - skip-ci: ${{ inputs.skip-ci }} - pre-commit: ${{ inputs.pre-commit }} - pre-release: ${{ inputs.pre-release }} - - - name: Create Release - id: create_release - uses: softprops/action-gh-release@v1 - if: ${{ steps.conventional_changelog.outputs.skipped == 'false' }} - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_ACCESS_TOKEN }} - with: - tag_name: ${{ steps.conventional_changelog.outputs.tag }} - body: ${{ steps.conventional_changelog.outputs.clean_changelog }} diff --git a/.release-please-manifest.json b/.release-please-manifest.json new file mode 100644 index 0000000..582db2f --- /dev/null +++ b/.release-please-manifest.json @@ -0,0 +1,3 @@ +{ + ".": "0.10.2" +} diff --git a/release-please-config.json b/release-please-config.json new file mode 100644 index 0000000..e956fb1 --- /dev/null +++ b/release-please-config.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", + "packages": { + ".": { + "release-type": "node", + "include-component-in-tag": false + } + } +}