better-auth/.github/workflows/promote.yml

name: Promote Beta to Stable

on:
  workflow_dispatch: {}

permissions: {}

jobs:
  promote:
    if: github.repository_owner == 'better-auth' && github.ref == 'refs/heads/next'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Generate App Token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        if: vars.RELEASE_APP_ID != ''
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: next
          persist-credentials: false
          token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}

      - uses: better-auth/shared-workflows/.github/actions/setup-pnpm@08e5520e7a829b03bee1152913682b67d2ba44b1

      - name: Exit pre-release and version
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
        run: |
          if [ -f .changeset/pre.json ]; then
            pnpm changeset pre exit
          else
            echo "Already out of pre-release mode (retrying previous run?)"
          fi
          pnpm ci:version

      - name: Read version
        id: version
        run: |
          VERSION=$(node -e "console.log(require('./packages/better-auth/package.json').version.replace(/[^0-9.]/g, ''))")
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Promoting to v$VERSION"

      - name: Commit and push
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          git config user.name "better-release[bot]"
          git config user.email "273320539+better-release[bot]@users.noreply.github.com"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git add -A
          if git diff --cached --quiet; then
            echo "No changes to commit (previous run already pushed)"
          else
            git commit -m "chore: exit pre-release mode for v${VERSION}"
            git push origin next || { echo "::error::Push to next failed. Check branch protection rules."; exit 1; }
          fi

      - name: Create promote PR
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          EXISTING=$(gh pr list --base main --head next --state open --repo "$GITHUB_REPOSITORY" --json number --jq '.[0].number // empty')
          if [ -n "$EXISTING" ]; then
            echo "Promote PR #$EXISTING already exists"
          else
            BODY_FILE=$(mktemp)
            # shellcheck disable=SC2016
            printf '%s\n' \
              '> [!IMPORTANT]' \
              '> Keep this PR in Draft. Run `/release-notes` to generate and review the release notes.' \
              '> The release bot marks the PR ready when the preview matches the current head. Do not manually mark it ready.' \
              '' \
              "Promotes v${VERSION} from beta to stable. Merging this PR publishes all packages to npm with the \`latest\` tag." \
              '' \
              "**This PR must be merged by an admin using 'Create a merge commit'** (not squash, not rebase). The admin bypass is required because main enforces linear history for regular PRs, but the promotion needs a merge commit to preserve individual contributor commits and their verified signatures." \
              > "$BODY_FILE"
            gh pr create \
              --draft \
              --base main \
              --head next \
              --title "chore: promote v${VERSION} to stable" \
              --body-file "$BODY_FILE"
            rm -f "$BODY_FILE"
          fi

      - name: Summary
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          {
            echo "### Beta promoted"
            echo ""
            echo "- **Version:** \`$VERSION\`"
            echo "- **Action:** Review and merge the PR with **Create a merge commit** (admin bypass)."
            echo ""
            echo "### After promotion"
            echo "Once the promote PR is merged and the sync PR (main to next) is merged:"
            echo '```'
            echo "pnpm changeset pre enter beta && git add .changeset/pre.json && git commit -m 'chore: re-enter beta pre-release mode' && git push origin next"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"