Repository navigation
ci: hold releases on the release-approval environment instead of a runner - #79
Merged
Merged
Conversation
…nner The release run staged zshy and then polled npm inside the job for up to 350 minutes, so an approval that came later needed a re-run. It now follows nub's release.yml at zshy's scale, in one dispatch-only workflow with a publish input (default off, a dry run that stages nothing): - verify reads the version and refuses, before anything is built, a ref other than main, a VERSION.txt that package.json disagrees with, a tag at another commit, a version npm serves from another commit, a version not above npm's latest, and a release-approval environment that has no required reviewer or admits branches other than main. GitHub creates an unknown environment with no protection on first use, so the gate is read back rather than assumed. A dry run reports these as warnings. - build tests, builds, packs with `versace.ts pack`, and installs the tarball into a scratch project to build a library with it. It holds no npm credential and uses no dependency cache. - stage gets only the tarball, and stages it through the stage-only trusted publisher. It is the only job with id-token: write, and it runs none of the repo's code or dependencies. - await-approval is a job on release-approval, so GitHub holds the run with no runner for up to 30 days. Once approved, it waits for npm to serve the version, checks that npm serves this run's tarball (or, for a version this run did not stage, that its provenance names this commit and workflow), and pushes the tag with a deploy key held only by that environment. - npm-served installs the release from npm and builds with it, and github-release creates the release on the existing tag with `--verify-tag`, so no job token writes a ref. stager finds the held run to resume by the version in package.json at the run's commit, so package.json now carries the released version (0.8.0) and versace.ts puts the original back instead of 0.0.0. The file keeps its name because npm's trusted publisher is bound to it. publish-canary.yml is gone: it no longer reached npm, and test.yml already tests and builds every push to main. The shared setup action is pinned and can turn its cache off.
Contributor
|
No configured credential can serve this run. Your Claude Pro/Max subscription was rejected. Sign in again by running The providers' responses
|
The first dry run on GitHub failed at the pack step: npm pack --pack-destination does not create the directory it is given.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the shape of nubjs/nub's
release.ymlto zshy. Today the release run stages zshy, then a runner polls npm for up to 350 minutes waiting for the 2FA approval, so a late approval needs a re-run. Now GitHub holds the run on therelease-approvalenvironment with no runner, for up to 30 days, and nothing is tagged or released until npm actually serves the version this run built.The file keeps its name,
publish-latest.yml, because npm's trusted publisher for zshy is bound to it (zshy@0.8.0's provenance names it). Its display name is now "Release". This supersedes the unmergedci/release-approval-environmentbranch (970203a).Jobs
main;VERSION.txtandpackage.jsondisagreeing; the tag already existing at another commit; npm already serving the version and the release existing; npm serving the version from another commit (by its provenance); a version not above npm'slatest; and arelease-approvalenvironment that is missing, has no required reviewer, or admits branches other thanmain. GitHub creates an unknown environment with no protection on first use, so the gate is read back rather than assumed. On a dry run these are warnings. Lookups fail closed. It also writes the release notes.versace.ts pack, and installs the tarball into an empty project to build a library with it. A dry run ends here.id-token: write, no checkout) stages that exact tarball through the stage-only trusted publisher. It runs none of the repo's code or dependencies. Already live or already staged is not staged again.release-approval. Once approved it waits for npm to serve the version, checks npm serves this run's tarball (or that the provenance names this commit and workflow), and pushes thev<version>tag with a deploy key only that environment holds.contents: write, no checkout) creates the release on the existing tag with--verify-tag.Also
package.jsoncarries the released version (0.8.0) instead of 0.0.0, becausestagerfinds the held run by the version inpackage.jsonat the run's commit. A release commit bumps both files; verify checks they match.publish-canary.ymlis deleted: it no longer reached npm, andtest.ymlalready tests and builds every push to main..github/scripts/smoke-install.shloads every entry point zshy writes, throughimportandrequire, so it works for today's dual output and the ESM-only output of feat!: build ES modules only #78.Settings outside the repo
The
release-approvalenvironment exists (reviewer colinhacks). Until it is restricted tomain, verify refuses a publishing run. The tag deploy key, theRELEASE_TAG_KEYsecret and a tag-creation ruleset are also needed. npm needs no change if its trusted publisher is GitHub Actions /colinhacks/zshy/publish-latest.ymlwith no environment.Verified locally: actionlint and shellcheck pass; zizmor reports nothing high or medium; verify's shell ran against the live API;
check-provenance.shpasses on 0.8.0 at its commit and fails elsewhere; the smoke install passes on both builds.