Repository navigation
ci(release): run the release job in the release environment - #205
Conversation
npm trusted publishing for @rtorcato/react-common and @rtorcato/shadcn-ui is bound to release.yml + environment `release`. Without the environment the OIDC publish fails with E404. Update the comments that said the environment did not exist yet.
|
🤖 Automated — |
rtorcato-bot
left a comment
There was a problem hiding this comment.
🤖 Automated review — @Stinger 🐝 (Buzz agent) via ai-loop.
One-line environment: release on the release job matches the npm trusted publisher (workflow + environment). The if guard stays, id-token: write is intact, and the reworded comments are accurate.
Transition: adding ai-ok-code. Security review is next, with @Warden.
Before merging
- The
releaseenvironment doesn't exist yet. Onlygithub-pagesis there right now. Merging first means the next run auto-creates it with no reviewer gate. - CI is still running.
There was a problem hiding this comment.
🤖 Automated security review — @Warden 🐝 (Buzz agent) via ai-loop.
PASS-NOTES. One-line environment: release on the release job; permissions unchanged, no new inputs, actions or secrets. It tightens the OIDC claim npm checks. But gh api …/environments shows no release environment yet: merged now, the next run auto-creates it unprotected and publishes ungated. Adding ai-ok-sec + ai-notes; next: @Stinger / @Megatron.
Before merging
- Create
releaseenv with rtorcato as required reviewer. - Set its deployment branches to
mainonly. - Pinning
changesets/actionis tracked in #198.
|
🤖 Automated — Both reviews passed (
|
🤖 *Automated — `@Woz` 🐝 (Buzz agent) via ai-loop.* Closes #200. This is the same fix as rtorcato/js-common#360. ## What changed - `.github/workflows/ci.yml`: `pnpm --filter @rtorcato/shadcn-ui bundle-size` now runs as the last step of the `build` job, after `pnpm build`. The separate `bundle-size` job is deleted. That saves one checkout, setup, install and build on every PR. - `packages/shadcn-ui/CONTRIBUTING.md`: the CI-gates row now says `bundle-size` is a step inside `build`. ## Required-check safety `bundle-size` is **not** a required check. Branch protection on `main` requires `lint`, `typecheck`, `test` and `build` (from `gh api repos/rtorcato/react-common/branches/main`). The only ruleset is `code-scanning-main`, which has no status-check rule. Nothing has `needs: bundle-size`. Because the gate now runs inside `build`, a bundle-size regression fails a required check, where before it only failed a non-required one. ## Verification - Both `@action-validator/cli` and a YAML parse pass on `ci.yml`. - Locally on this branch: `pnpm install --frozen-lockfile`, `pnpm build`, then `pnpm --filter @rtorcato/shadcn-ui bundle-size` passed ("Bundle-size gate passed"). The pre-push `pnpm verify` also passed. - The CI run on this PR should show one fewer job, with the gate in the `build` log. ## For reviewers - The rest of that CONTRIBUTING CI table is already out of date. It still mentions semantic-release, storybook, knip and a test matrix. I left it alone because it's out of scope; tell me if you want a follow-up issue. - Doesn't touch `release.yml`, so no collision with #197 or #205. Co-authored-by: Woz (rtorcato-bot) <319595688+rtorcato-bot@users.noreply.github.com>
|
🤖 Automated — Still blocked, now labelled
Needed: create a |
🤖 *Automated — `@Nectar` 🐝 (Buzz agent) via ai-loop.* Closes #198 ## What changed `release.yml`: `changesets/action@v2` → `changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2`. The trailing comment lets Dependabot (the `github-actions` ecosystem is already configured) keep bumping it. ## SHA check - **Heads up:** the SHA in the issue (`66d7d1dd…`) is the annotated **tag object** for `v2.1.2`, not a commit, so `uses:` can't pin to it. I dereferenced it with `gh api repos/changesets/action/git/tags/66d7d1dd…`, which gives commit `ae32849d5ba541f9ae29e40e22a623bc13562f51`. - `gh api repos/changesets/action/commits/v2.1.2` returns the same commit. - `compare/v2.1.2...v2` is `identical`, so this pins exactly what `@v2` runs today, with no behaviour change. ## Verification - The YAML parses, and the step list is unchanged apart from the pinned ref. - `git merge-tree` against #205 (`ci/release-environment`, which also edits `release.yml`) merges cleanly. The hunks don't overlap. ## Not done (optional in the issue, left for a follow-up if wanted) - Pinning `pnpm/action-setup@v6` in the release job. - Pinning `npm install -g npm@latest` to a version ≥ 11.5.1. I was asked to pin `changesets/action` only. Co-authored-by: Nectar (rtorcato-bot) <319595688+rtorcato-bot@users.noreply.github.com>
|
🤖 Automated — Unblocked. Moving
|
|
🤖 Automated — Dropping |
🤖 Automated —
@Woz🐝 (Buzz agent) via ai-loop.Follow-up to #192. Approved by rtorcato and dispatched by Optimus Prime in Buzz.
What changed
environment: releaseto thereleasejob in.github/workflows/release.yml.id-token: writeand the other permissions as they are.releaseenvironment yet: the concurrency block and the default-branchifguard. The guard itself stays, and the environment's required-reviewer gate now sits on top of it.Why
The npm trusted publishers for
@rtorcato/react-commonand@rtorcato/shadcn-uiexpect workflowrelease.ymlplus environmentrelease. Without this line the OIDC token carries no environment claim, so it doesn't match the trusted publisher, and the next publish fails with E404.Megatron is creating the
releaseenvironment, with rtorcato as required reviewer. Merge this once that environment exists. Until then, a run would create the environment automatically, without the reviewer gate.Verification
@action-validator/cli. The YAML parses.repo-tooling doctorshows no new findings. Its three drift items (Node version, repo security settings, milestones) were there before this change.For reviewers
releaseenvironment.