Simplify the release workflow - #17
Conversation
📝 WalkthroughWalkthroughThe release process now runs on pushes to ChangesBenchmark mode selection
Push-triggered release automation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant Changesets
participant PublishRelease
participant NpmRegistry
participant GitHubRelease
GitHubActions->>Changesets: Run changeset:publish on main push
Changesets->>PublishRelease: Start publish or finalize status
PublishRelease->>NpmRegistry: Build, publish, and verify package artifacts
PublishRelease->>GitHubRelease: Create aggregate tag and GitHub release
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (6)
scripts/ci-workflow.test.mjs (2)
114-120: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winCheck
version_prat workflow scope.
.github/workflows/chart-library-benchmarks.ymlLine 12 removes a top-level dispatch input. Ifconformanceis an extracted job block,assert.doesNotMatch(conformance, /version_pr/)will not detect a stale top-level input. Assert against the full workflow or theworkflow_dispatch.inputsblock.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/ci-workflow.test.mjs` around lines 114 - 120, Update the version_pr assertion in the workflow test to inspect the full workflow content or specifically its workflow_dispatch.inputs block, rather than only the extracted conformance job block. Preserve the check that no version_pr declaration remains at workflow scope.
114-120: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winBind each event condition to its command.
These assertions check predicates and commands independently. A workflow that swaps the quick and standard
ifexpressions can still pass. Assert each named step'sifandrunpair for conformance and stress.Also applies to: 162-168
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/ci-workflow.test.mjs` around lines 114 - 120, Update the conformance and stress assertions in the workflow test to validate each named step’s event condition together with its corresponding run command, rather than matching predicates and commands independently. Ensure the quick/standard commands remain bound to the correct pull_request and non-pull_request conditions, preventing swapped conditions from passing..github/workflows/release.yml (2)
69-79: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRename the
dispatchoutput to match the new flow.The workflow no longer dispatches a release workflow. The step condition still reads
steps.status.outputs.dispatch, which now means "create the GitHub release". Rename the output inscripts/release-status.mjs, this condition, and the contract assertion inscripts/release-workflow.test.mjs(Line 119) to something likecreate_release.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 69 - 79, Rename the release-status output from dispatch to create_release across scripts/release-status.mjs, the Create GitHub release condition in the workflow, and the contract assertion in scripts/release-workflow.test.mjs. Ensure the output producer, consumer, and test expectation use the same create_release key.
3-6: 🩺 Stability & Availability | 🔵 TrivialPublication now starts before main CI reports a result.
Every push to
mainstarts publishing when no changesets remain. The job builds and validates tarballs, but it does not wait for the chart, browser, or catalog workflow. A broken merge can therefore reach npm, and npm versions cannot be replaced. F-147 records this as an accepted tradeoff. Consider gating the publish path on the main CI conclusion for the version commit, or keep a manual re-run path for the rare case where main CI fails after a version merge.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 3 - 6, Update the release workflow’s publish path triggered by pushes to main so publication is gated on the corresponding main CI result for the version commit, or provide an explicit manual re-run path when that CI fails after a version merge. Preserve the existing no-changesets publication behavior while preventing automatic npm publication before CI concludes.package.json (1)
57-57: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueTwo script names now run the same command.
release:publish(Line 53) andchangeset:publishrunnode scripts/publish-release.mjs. Keep one entry point, or makechangeset:publishdelegate withpnpm release:publish. If you delegate, update the pinned string inscripts/release-workflow.test.mjs(Line 53).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 57, Remove the duplicate command from the changeset:publish script by keeping a single release entry point, or change changeset:publish to delegate to release:publish via pnpm. If delegation is used, update the expected pinned command in the release workflow test.scripts/release-workflow.test.mjs (1)
82-107: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚖️ Poor tradeoffSource-text assertions couple the test to formatting.
The test matches literal source fragments of
scripts/publish-release.mjs, including the template literal at Line 101 and call ordering by string offset. A rename, a prettier reflow, or an extracted helper breaks the test without changing behavior. Consider exporting the publisher stages frompublish-release.mjsand asserting the behavior directly, and keep source-text checks only for the workflow YAML contract.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/release-workflow.test.mjs` around lines 82 - 107, The release workflow test’s source-text assertions are coupled to formatting and implementation layout rather than behavior. Refactor publish-release.mjs to export its publisher stages or other testable interfaces, then update the test named “builds checked tarballs only when npm has a release to publish” to invoke and assert those behaviors directly; retain source-text checks only for the workflow YAML contract.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 36-48: Update the changesets action reference in the “Create
version pull request or publish” step to a valid commit SHA for
changesets/action v1.8.0, while preserving the existing version, publish, and
release configuration.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 69-79: Rename the release-status output from dispatch to
create_release across scripts/release-status.mjs, the Create GitHub release
condition in the workflow, and the contract assertion in
scripts/release-workflow.test.mjs. Ensure the output producer, consumer, and
test expectation use the same create_release key.
- Around line 3-6: Update the release workflow’s publish path triggered by
pushes to main so publication is gated on the corresponding main CI result for
the version commit, or provide an explicit manual re-run path when that CI fails
after a version merge. Preserve the existing no-changesets publication behavior
while preventing automatic npm publication before CI concludes.
In `@package.json`:
- Line 57: Remove the duplicate command from the changeset:publish script by
keeping a single release entry point, or change changeset:publish to delegate to
release:publish via pnpm. If delegation is used, update the expected pinned
command in the release workflow test.
In `@scripts/ci-workflow.test.mjs`:
- Around line 114-120: Update the version_pr assertion in the workflow test to
inspect the full workflow content or specifically its workflow_dispatch.inputs
block, rather than only the extracted conformance job block. Preserve the check
that no version_pr declaration remains at workflow scope.
- Around line 114-120: Update the conformance and stress assertions in the
workflow test to validate each named step’s event condition together with its
corresponding run command, rather than matching predicates and commands
independently. Ensure the quick/standard commands remain bound to the correct
pull_request and non-pull_request conditions, preventing swapped conditions from
passing.
In `@scripts/release-workflow.test.mjs`:
- Around line 82-107: The release workflow test’s source-text assertions are
coupled to formatting and implementation layout rather than behavior. Refactor
publish-release.mjs to export its publisher stages or other testable interfaces,
then update the test named “builds checked tarballs only when npm has a release
to publish” to invoke and assert those behaviors directly; retain source-text
checks only for the workflow YAML contract.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f52f0a9b-c535-40f7-b199-3431eb215a1f
📒 Files selected for processing (14)
.github/workflows/chart-library-benchmarks.yml.github/workflows/release.ymlAPI-FRICTION.mdCONTRIBUTING.mdpackage.jsonscripts/ci-workflow.test.mjsscripts/publish-release.mjsscripts/release-security.mjsscripts/release-security.test.mjsscripts/release-workflow.test.mjsscripts/verify-ci-success.mjsscripts/verify-ci-success.test.mjsscripts/verify-published-release.mjsscripts/verify-release-revision.mjs
💤 Files with no reviewable changes (5)
- scripts/verify-ci-success.test.mjs
- scripts/verify-release-revision.mjs
- scripts/verify-ci-success.mjs
- scripts/verify-published-release.mjs
- scripts/release-security.mjs
| - name: Create version pull request or publish | ||
| id: changesets | ||
| uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0 | ||
| with: | ||
| branch: main | ||
| version: pnpm changeset:version | ||
| publish: pnpm changeset:publish | ||
| title: 'ci: Version Packages' | ||
| commit: 'ci: changeset release' | ||
| createGithubReleases: false | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| RELEASE_REVISION: ${{ github.sha }} |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Resolve the pinned changesets/action revision and inspect its action inputs.
set -euo pipefail
gh api repos/changesets/action/git/refs/tags --jq '.[] | "\(.ref) \(.object.sha)"'
gh api repos/changesets/action/contents/action.yml?ref=63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b \
--jq '.content' | base64 -d | sed -n '1,80p'Repository: TanStack/charts
Length of output: 4375
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Pinned SHA:\n'
printf '%s\n' '63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b'
printf '\nIs pinned SHA a valid commit?\n'
gh api repos/changesets/action/commits/63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b --jq '{sha: .sha, commit_sha: .commit.sha, node_id: .node_id}'
printf '\nResolved v1.8.0 tag:\n'
gh api repos/changesets/action/git/refs/tags/v1.8.0 \
--jq 'if .object.type=="tag" then gs=.object.sha; gh api repos/changesets/action/git/tags/$gs --jq "{ref:\"v1.8.0 dereferenced commit\", sha: .object.sha}" else "{ref:\"v1.8.0 direct commit\", sha: .object.sha}" end'
printf '\nIs pinned SHA a git tag object?\n'
gh api repos/changesets/action/git/tags/63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b \
--jq '{possibly_tag_object: true, object_type: .object.type, message: .message, target_commitish: .object.sha}' \
|| true
printf '\nRelevant action.yml inputs from pinned SHA:\n'
gh api repos/changesets/action/contents/action.yml?ref=63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b \
--jq '.content' | base64 -d | sed -n '1,60p'
printf '\nSearch changeset publish behavior in pinned dist (if present):\n'
gh api repos/changesets/action/contents/dist/index.js?ref=63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b \
--jq '.content' | base64 -d | sed -n '1,160p'Repository: TanStack/charts
Length of output: 744
Point the release step at a real v1.8.0 commit.
changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b is not a valid commit, even though the action file was shown for that ref. Use a valid v1.8.0 commit SHA so version, publish, and release creation can run.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 36 - 48, Update the changesets
action reference in the “Create version pull request or publish” step to a valid
commit SHA for changesets/action v1.8.0, while preserving the existing version,
publish, and release configuration.
1 participant
Summary
Validation
Summary by CodeRabbit
Release Improvements
Benchmarking
Documentation