github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #8903] [MERGED] ci: replace bumpp with changesets release automation #25189

New Issue
Closed
opened 2026-04-15 22:45:27 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:45:27 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/8903
Author: @gustavovalverde
Created: 4/1/2026
Status: ✅ Merged
Merged: 4/3/2026
Merged by: @gustavovalverde

Base: main ← Head: ci/release-automation

📝 Commits (10+)

  • 3fadfca ci: replace bumpp with changesets release automation
  • 1cc325d ci: enforce patch-only main and block breaking changes
  • ea9df33 ci: add nightly snapshots and fix snapshot in pre-release mode
  • 762d7b8 Revert "ci: add nightly snapshots and fix snapshot in pre-release mode"
  • 9a50819 ci: add automated beta branch creation and release/** trigger
  • 2b4421b fix(ci): replace unsafe ${{ }} interpolation with env vars in run blocks
  • 56d72d9 fix(ci): remove unused tinyglobby devDependency
  • 3233c1f fix(ci): address review feedback on release workflows
  • fa9d62d chore: reset package versions to 1.5.6 and clean up old references
  • 595d239 Revert "chore: reset package versions to 1.5.6 and clean up old references"

📊 Changes

16 files changed (+981 additions, -103 deletions)

View changed files

➕ .changeset/README.md (+8 -0)
➕ .changeset/config.json (+18 -0)
📝 .cspell/third-party.txt (+4 -1)
➕ .github/workflows/backport.yml (+77 -0)
📝 .github/workflows/ci.yml (+1 -0)
📝 .github/workflows/e2e.yml (+3 -1)
📝 .github/workflows/npm-dist-tag.yml (+7 -1)
📝 .github/workflows/preview.yml (+1 -1)
➕ .github/workflows/promote.yml (+96 -0)
📝 .github/workflows/release.yml (+159 -39)
📝 .github/workflows/semantic-pull-request.yml (+14 -0)
➕ .github/workflows/verify-changesets.yml (+141 -0)
➖ bump.config.ts (+0 -6)
📝 knip.jsonc (+2 -3)
📝 package.json (+5 -6)
📝 pnpm-lock.yaml (+445 -45)

📄 Description

Summary

Replaces the manual bumpp-based release with Changesets and automated workflows.

Two long-lived branches:

  • main — stable patches, publishes with latest npm tag
  • next — pre-release (beta), publishes with beta npm tag

next is always a superset of main. After every push to main, the release workflow rebases next onto main (linear history, no merge commits). When promoting a beta to stable, a rebase-merge preserves individual commits on main.

Workflows

Workflow Trigger Purpose
release.yml Push to main/next/release/** Version PRs, publish, rebase forward sync
promote.yml Manual dispatch on next Exit pre-release mode, create PR next → main
verify-changesets.yml PRs to main/next/release/** Changeset policy enforcement
backport.yml PR merged + label or /backport comment Cherry-pick to other branches
npm-dist-tag.yml Manual dispatch npm dist-tag correction

Release cadence

What ships Branch Bump type npm tag
Bug fixes main patch latest
Features / breaking changes next minor / major beta
Old-version maintenance release/** patch version-specific

Policy enforcement

  • Patch-only on main and release/**: verify-changesets.yml blocks minor/major changesets
  • Breaking change detection: semantic-pull-request.yml rejects ! indicator on PRs targeting main
  • Pre-release isolation: pre.json is blocked from being added to main (allowed to be removed for promotion)
  • Changeset validation: Rejects symlinks (CWE-59), validates filename format, verifies frontmatter structure and entry format
  • Backport guard: Only MEMBER/OWNER/COLLABORATOR can trigger /backport, only on merged PRs

Security

  • All actions SHA-pinned
  • Fork guard (repository_owner == 'better-auth') on all privileged jobs
  • persist-credentials: false on all read-only checkouts
  • No ${{ }} expressions in run: blocks — all user-controlled values via env:
  • OIDC trusted publishing (no long-lived NPM_TOKEN for publish)
  • Snapshot dist-tags reject reserved names (latest, beta, next, rc)
  • npm-dist-tag rejects tagging pre-release versions as latest
  • Manual dispatch restricted to allowed branches

Post-merge steps

  1. Create next branch from main
  2. Enter pre-release mode: pnpm changeset pre enter beta
  3. Add catch-up changeset (minor bump for features since 1.5.6)
  4. Push → automation creates Version Packages PR → merge → publishes 1.6.0-beta.0
  5. Create labels: skip-changeset, backport next, backport-auto-merge

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/8903 **Author:** [@gustavovalverde](https://github.com/gustavovalverde) **Created:** 4/1/2026 **Status:** ✅ Merged **Merged:** 4/3/2026 **Merged by:** [@gustavovalverde](https://github.com/gustavovalverde) **Base:** `main` ← **Head:** `ci/release-automation` --- ### 📝 Commits (10+) - [`3fadfca`](https://github.com/better-auth/better-auth/commit/3fadfcac6a1398175fe6b530c77d98cedfbb6269) ci: replace bumpp with changesets release automation - [`1cc325d`](https://github.com/better-auth/better-auth/commit/1cc325d2a55d995188c11b44637b45c87f9820f3) ci: enforce patch-only main and block breaking changes - [`ea9df33`](https://github.com/better-auth/better-auth/commit/ea9df3309c0b05b3d8bf52bd496f0cf420726f3a) ci: add nightly snapshots and fix snapshot in pre-release mode - [`762d7b8`](https://github.com/better-auth/better-auth/commit/762d7b8464769b443952d0af25a6f72764b4b469) Revert "ci: add nightly snapshots and fix snapshot in pre-release mode" - [`9a50819`](https://github.com/better-auth/better-auth/commit/9a5081942f8ac1bf240fe9c287f839b4bcd136b1) ci: add automated beta branch creation and release/** trigger - [`2b4421b`](https://github.com/better-auth/better-auth/commit/2b4421b165a03b8c8b5964088e5c0274cfef68fb) fix(ci): replace unsafe ${{ }} interpolation with env vars in run blocks - [`56d72d9`](https://github.com/better-auth/better-auth/commit/56d72d9a584a896a796cd9f798acdcaf3aed0c50) fix(ci): remove unused tinyglobby devDependency - [`3233c1f`](https://github.com/better-auth/better-auth/commit/3233c1feb56bf4d6470e5632472835c3347d6374) fix(ci): address review feedback on release workflows - [`fa9d62d`](https://github.com/better-auth/better-auth/commit/fa9d62d79faf163a91c3b2f1fa4f9fc6e421e555) chore: reset package versions to 1.5.6 and clean up old references - [`595d239`](https://github.com/better-auth/better-auth/commit/595d23986c10f94496d42dcc1dee8435020c14cf) Revert "chore: reset package versions to 1.5.6 and clean up old references" ### 📊 Changes **16 files changed** (+981 additions, -103 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/README.md` (+8 -0) ➕ `.changeset/config.json` (+18 -0) 📝 `.cspell/third-party.txt` (+4 -1) ➕ `.github/workflows/backport.yml` (+77 -0) 📝 `.github/workflows/ci.yml` (+1 -0) 📝 `.github/workflows/e2e.yml` (+3 -1) 📝 `.github/workflows/npm-dist-tag.yml` (+7 -1) 📝 `.github/workflows/preview.yml` (+1 -1) ➕ `.github/workflows/promote.yml` (+96 -0) 📝 `.github/workflows/release.yml` (+159 -39) 📝 `.github/workflows/semantic-pull-request.yml` (+14 -0) ➕ `.github/workflows/verify-changesets.yml` (+141 -0) ➖ `bump.config.ts` (+0 -6) 📝 `knip.jsonc` (+2 -3) 📝 `package.json` (+5 -6) 📝 `pnpm-lock.yaml` (+445 -45) </details> ### 📄 Description ## Summary Replaces the manual `bumpp`-based release with [Changesets](https://github.com/changesets/changesets) and automated workflows. Two long-lived branches: - `main` — stable patches, publishes with `latest` npm tag - `next` — pre-release (beta), publishes with `beta` npm tag `next` is always a superset of `main`. After every push to `main`, the release workflow rebases `next` onto `main` (linear history, no merge commits). When promoting a beta to stable, a rebase-merge preserves individual commits on `main`. ### Workflows | Workflow | Trigger | Purpose | |----------|---------|---------| | `release.yml` | Push to `main`/`next`/`release/**` | Version PRs, publish, rebase forward sync | | `promote.yml` | Manual dispatch on `next` | Exit pre-release mode, create PR `next → main` | | `verify-changesets.yml` | PRs to `main`/`next`/`release/**` | Changeset policy enforcement | | `backport.yml` | PR merged + label or `/backport` comment | Cherry-pick to other branches | | `npm-dist-tag.yml` | Manual dispatch | npm dist-tag correction | ### Release cadence | What ships | Branch | Bump type | npm tag | |---|---|---|---| | Bug fixes | `main` | `patch` | `latest` | | Features / breaking changes | `next` | `minor` / `major` | `beta` | | Old-version maintenance | `release/**` | `patch` | version-specific | ### Policy enforcement - **Patch-only on `main` and `release/**`**: `verify-changesets.yml` blocks `minor`/`major` changesets - **Breaking change detection**: `semantic-pull-request.yml` rejects `!` indicator on PRs targeting `main` - **Pre-release isolation**: `pre.json` is blocked from being added to `main` (allowed to be removed for promotion) - **Changeset validation**: Rejects symlinks (CWE-59), validates filename format, verifies frontmatter structure and entry format - **Backport guard**: Only MEMBER/OWNER/COLLABORATOR can trigger `/backport`, only on merged PRs ### Security - All actions SHA-pinned - Fork guard (`repository_owner == 'better-auth'`) on all privileged jobs - `persist-credentials: false` on all read-only checkouts - No `${{ }}` expressions in `run:` blocks — all user-controlled values via `env:` - OIDC trusted publishing (no long-lived `NPM_TOKEN` for publish) - Snapshot dist-tags reject reserved names (`latest`, `beta`, `next`, `rc`) - `npm-dist-tag` rejects tagging pre-release versions as `latest` - Manual dispatch restricted to allowed branches ### Post-merge steps 1. Create `next` branch from `main` 2. Enter pre-release mode: `pnpm changeset pre enter beta` 3. Add catch-up changeset (minor bump for features since 1.5.6) 4. Push → automation creates Version Packages PR → merge → publishes `1.6.0-beta.0` 5. Create labels: `skip-changeset`, `backport next`, `backport-auto-merge` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:45:27 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25189
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?