Skip to content

Simplify the release workflow #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tannerlinsley merged 1 commit into from
Jul 31, 2026
Merged

Simplify the release workflow #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 4 additions & 9 deletions .github/workflows/chart-library-benchmarks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,6 @@ on:
- cron: '17 7 * * 1'
workflow_dispatch:
inputs:
version_pr:
description: Run the pull-request validation profile
required: false
type: boolean
default: false
upload_bundle_baseline_candidate:
description: Upload exact comparison bundle measurements
required: false
Expand Down Expand Up @@ -153,11 +148,11 @@ jobs:
playwright: 'true'

- name: Run pull-request conformance shard
if: github.event_name == 'pull_request' || inputs.version_pr
if: github.event_name == 'pull_request'
run: pnpm conformance:quick -- --shard=${{ matrix.shard }}/8

- name: Run production conformance shard
if: github.event_name != 'pull_request' && !inputs.version_pr
if: github.event_name != 'pull_request'
run: pnpm conformance -- --shard=${{ matrix.shard }}/8

- name: Publish conformance summary
Expand Down Expand Up @@ -209,11 +204,11 @@ jobs:
run: pnpm exec vitest run benchmarks/comparison/stress

- name: Run quick stress shard
if: github.event_name == 'pull_request' || github.event_name == 'push' || inputs.version_pr
if: github.event_name == 'pull_request' || github.event_name == 'push'
run: pnpm benchmark:stress:quick -- --workload=${{ matrix.workloads }}

- name: Run standard stress shard
if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && !inputs.version_pr)
if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
run: pnpm benchmark:stress:standard -- --workload=${{ matrix.workloads }}

- name: Publish stress summary
Expand Down
228 changes: 20 additions & 208 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,268 +1,80 @@
name: Publish release
name: Release

on:
push:
tags:
- 'v*'
workflow_dispatch:
workflow_run:
workflows:
- Chart library benchmarks
types:
- completed
branches:
- main

permissions:
contents: read

concurrency:
group: charts-release
group: charts-release-${{ github.ref }}
cancel-in-progress: false

jobs:
version:
name: Version pull request
if: >-
github.event_name == 'workflow_run' &&
github.event.workflow_run.conclusion == 'success' &&
github.event.workflow_run.event == 'push' &&
github.event.workflow_run.head_branch == 'main'
release:
name: Release
if: github.repository_owner == 'TanStack'
runs-on: ubuntu-24.04
timeout-minutes: 10
timeout-minutes: 20
permissions:
actions: write
contents: write
id-token: write
pull-requests: write

steps:
- name: Checkout validated main
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.event.workflow_run.head_sha }}
fetch-depth: 0
persist-credentials: true

- name: Setup
uses: ./.github/actions/setup

- name: Create or update version pull request
- name: Create version pull request or publish
id: changesets
uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
with:
branch: main
version: pnpm changeset:version
publish: pnpm changeset:publish
title: 'ci: Version Packages'
commit: 'ci: changeset release'
createGithubReleases: false
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
RELEASE_REVISION: ${{ github.sha }}
Comment on lines +36 to +48

@coderabbitai coderabbitai Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Resolve the pinned changesets/action revision and inspect its action inputs.
set -euo pipefail

gh api repos/changesets/action/git/refs/tags --jq '.[] | "\(.ref) \(.object.sha)"'
gh api repos/changesets/action/contents/action.yml?ref=63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b \
  --jq '.content' | base64 -d | sed -n '1,80p'

Repository: TanStack/charts

Length of output: 4375

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Pinned SHA:\n'
printf '%s\n' '63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b'

printf '\nIs pinned SHA a valid commit?\n'
gh api repos/changesets/action/commits/63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b --jq '{sha: .sha, commit_sha: .commit.sha, node_id: .node_id}'

printf '\nResolved v1.8.0 tag:\n'
gh api repos/changesets/action/git/refs/tags/v1.8.0 \
  --jq 'if .object.type=="tag" then gs=.object.sha; gh api repos/changesets/action/git/tags/$gs --jq "{ref:\"v1.8.0 dereferenced commit\", sha: .object.sha}" else "{ref:\"v1.8.0 direct commit\", sha: .object.sha}" end'

printf '\nIs pinned SHA a git tag object?\n'
gh api repos/changesets/action/git/tags/63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b \
  --jq '{possibly_tag_object: true, object_type: .object.type, message: .message, target_commitish: .object.sha}' \
  || true

printf '\nRelevant action.yml inputs from pinned SHA:\n'
gh api repos/changesets/action/contents/action.yml?ref=63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b \
  --jq '.content' | base64 -d | sed -n '1,60p'

printf '\nSearch changeset publish behavior in pinned dist (if present):\n'
gh api repos/changesets/action/contents/dist/index.js?ref=63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b \
  --jq '.content' | base64 -d | sed -n '1,160p'

Repository: TanStack/charts

Length of output: 744

Point the release step at a real v1.8.0 commit.

changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b is not a valid commit, even though the action file was shown for that ref. Use a valid v1.8.0 commit SHA so version, publish, and release creation can run.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 36 - 48, Update the changesets
action reference in the “Create version pull request or publish” step to a valid
commit SHA for changesets/action v1.8.0, while preserving the existing version,
publish, and release configuration.


- name: Validate version pull request
if: steps.changesets.outputs.pullRequestNumber != ''
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
VERSION_PR_NUMBER: ${{ steps.changesets.outputs.pullRequestNumber }}
run: |
version_ref=$(gh pr view "$VERSION_PR_NUMBER" \
--repo "$GITHUB_REPOSITORY" \
--json headRefName \
--jq .headRefName)
test -n "$version_ref"
gh workflow run chart-library-benchmarks.yml \
--repo "$GITHUB_REPOSITORY" \
--ref "$version_ref" \
-f version_pr=true

tag:
name: Dispatch validated release
needs: version
if: >-
github.event_name == 'workflow_run' &&
github.event.workflow_run.conclusion == 'success' &&
github.event.workflow_run.event == 'push' &&
github.event.workflow_run.head_branch == 'main'
runs-on: ubuntu-24.04
timeout-minutes: 10
permissions:
actions: write
contents: write

steps:
- name: Checkout validated main
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.event.workflow_run.head_sha }}
fetch-depth: 0
persist-credentials: true

- name: Setup
uses: ./.github/actions/setup

- name: Determine release status
- name: Determine release finalization
id: status
if: steps.changesets.outputs.hasChangesets == 'false'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
RELEASE_REVISION: ${{ github.event.workflow_run.head_sha }}
RELEASE_REVISION: ${{ github.sha }}
run: node scripts/release-status.mjs

- name: Create annotated release tag
if: steps.status.outputs.create_tag == 'true'
env:
RELEASE_TAG: ${{ steps.status.outputs.tag }}
RELEASE_REVISION: ${{ github.event.workflow_run.head_sha }}
RELEASE_REVISION: ${{ github.sha }}
run: |
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git tag -a "$RELEASE_TAG" "$RELEASE_REVISION" -m "TanStack Charts $RELEASE_TAG"
git push origin "refs/tags/$RELEASE_TAG"

- name: Dispatch tag-scoped OIDC release
- name: Create GitHub release
if: steps.status.outputs.dispatch == 'true'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
RELEASE_TAG: ${{ steps.status.outputs.tag }}
run: gh workflow run release.yml --ref "$RELEASE_TAG"

validate:
name: Build release candidate
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
runs-on: ubuntu-24.04
timeout-minutes: 15
permissions:
actions: read
contents: read

steps:
- name: Checkout tagged revision
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}
fetch-depth: 0
persist-credentials: false

- name: Setup
uses: ./.github/actions/setup

- name: Verify tag and successful exact-SHA CI
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
node scripts/verify-release-revision.mjs
node scripts/verify-ci-success.mjs

- name: Build fresh package artifacts
run: node scripts/build-release-artifacts.mjs

- name: Check release artifacts
run: node scripts/publish-release.mjs --check

- name: Upload checked package artifacts
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
name: charts-release-${{ github.ref_name }}
path: .release-artifacts
if-no-files-found: error
include-hidden-files: true

publish:
name: Publish with npm OIDC
needs: validate
if: needs.validate.result == 'success'
runs-on: ubuntu-24.04
timeout-minutes: 15
permissions:
contents: read
id-token: write

steps:
- name: Checkout tagged revision
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}
fetch-depth: 0
persist-credentials: false

- name: Setup Node
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version: 24.18.0
registry-url: https://registry.npmjs.org
package-manager-cache: false

- name: Download checked package artifacts
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: charts-release-${{ github.ref_name }}
path: .release-artifacts

- name: Revalidate refs and publish with OIDC
run: |
node scripts/verify-release-revision.mjs
node scripts/publish-release.mjs

verify:
name: Verify published packages
needs: publish
runs-on: ubuntu-24.04
timeout-minutes: 15
permissions:
contents: read

steps:
- name: Checkout tagged revision
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}
persist-credentials: false

- name: Setup Node
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version: 24.18.0
registry-url: https://registry.npmjs.org
package-manager-cache: false

- name: Download checked package artifacts
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: charts-release-${{ github.ref_name }}
path: .release-artifacts

- name: Verify installed packages, signatures, and provenance
run: node scripts/verify-published-release.mjs

release:
name: Create GitHub release
needs: verify
runs-on: ubuntu-24.04
timeout-minutes: 10
permissions:
contents: write

steps:
- name: Checkout tagged revision
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}
fetch-depth: 0
persist-credentials: false

- name: Setup Node
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version: 24.18.0
package-manager-cache: false

- name: Revalidate refs and create GitHub release
env:
GH_TOKEN: ${{ github.token }}
run: |
node scripts/verify-release-revision.mjs
if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
exit 0
fi
node scripts/write-release-notes.mjs /tmp/charts-release-notes.md
gh release create "$GITHUB_REF_NAME" \
gh release create "$RELEASE_TAG" \
--repo "$GITHUB_REPOSITORY" \
--verify-tag \
--title "TanStack Charts $GITHUB_REF_NAME" \
--title "TanStack Charts $RELEASE_TAG" \
--notes-file /tmp/charts-release-notes.md
Loading