Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions .github/workflows/release-please.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
name: Release Please

on:
push:
branches:
- main

permissions:
contents: write
pull-requests: write
id-token: write

jobs:
release-please:
runs-on: ubuntu-latest
outputs:
release_created: ${{ steps.release.outputs.release_created }}
steps:
- name: Generate token
id: generate-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ vars.SDK_BOT_APP_ID }}
private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }}

- uses: googleapis/release-please-action@v4
id: release
with:
token: ${{ steps.generate-token.outputs.token }}

publish:
needs: release-please
if: ${{ needs.release-please.outputs.release_created == 'true' }}
uses: ./.github/workflows/release.yml
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 No secrets: inherit for reusable workflow call

When release.yml is invoked via workflow_call, secrets from the caller are not automatically forwarded unless secrets: inherit is specified. If release.yml ever needs a secret (e.g. a fallback NODE_AUTH_TOKEN), it would silently receive an empty value. Since the current setup relies purely on OIDC this is likely fine, but adding secrets: inherit here is a low-cost safety net.

Suggested change
uses: ./.github/workflows/release.yml
uses: ./.github/workflows/release.yml
secrets: inherit

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's fine; we're not using secrets here/anymore.

18 changes: 4 additions & 14 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
@@ -1,11 +1,8 @@
name: Release

on:
# Support manually pushing a new release
workflow_dispatch: {}
# Trigger when a release is published
release:
types: [published]
workflow_dispatch:
workflow_call:

defaults:
run:
Expand Down Expand Up @@ -37,12 +34,5 @@ jobs:
run: |
pnpm run build

- name: Push Release
if: ${{ !github.event.release.prerelease }}
run: |
pnpm publish --tag latest --access=public --no-git-checks --provenance

- name: Push Pre-Release
if: ${{ github.event.release.prerelease }}
run: |
pnpm publish --tag next --access=public --no-git-checks --provenance
- name: Publish
run: pnpm publish --tag latest --access=public --provenance --no-git-checks
3 changes: 3 additions & 0 deletions .release-please-manifest.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
{
".": "0.5.0"
}
11 changes: 11 additions & 0 deletions release-please-config.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{
"$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
"include-component-in-tag": false,
"packages": {
".": {
"release-type": "node",
"changelog-path": "CHANGELOG.md",
"versioning": "default"
}
}
}
Loading