mirror of
https://github.com/better-auth/better-auth.git
synced 2026-10-18 11:32:15 -05:00
199 lines
7.5 KiB
YAML
199 lines
7.5 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- next
|
|
- release/**
|
|
workflow_dispatch:
|
|
inputs:
|
|
snapshot:
|
|
description: 'Snapshot tag (e.g. "snapshot"). Leave empty for normal release.'
|
|
required: false
|
|
default: ''
|
|
type: string
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref_name }}
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
|
|
TURBO_TEAM: ${{ vars.TURBO_TEAM || github.repository_owner }}
|
|
TURBO_CACHE: remote:rw
|
|
BETTER_AUTH_TELEMETRY_ENDPOINT: ${{ vars.BETTER_AUTH_TELEMETRY_ENDPOINT }}
|
|
|
|
jobs:
|
|
release:
|
|
if: >
|
|
(github.event_name != 'workflow_dispatch' || inputs.snapshot == '') &&
|
|
github.repository_owner == 'better-auth' &&
|
|
(github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/next' || startsWith(github.ref, 'refs/heads/release/'))
|
|
runs-on: ubuntu-latest
|
|
environment: Release
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
id-token: write
|
|
steps:
|
|
- name: Generate App Token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
|
|
if: vars.RELEASE_APP_ID != ''
|
|
with:
|
|
app-id: ${{ vars.RELEASE_APP_ID }}
|
|
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
|
|
|
|
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
|
|
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
|
|
|
|
- uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
|
|
with:
|
|
node-version-file: '.nvmrc'
|
|
cache: pnpm
|
|
registry-url: 'https://registry.npmjs.org'
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- name: Guard next branch pre-release state
|
|
id: guard
|
|
if: github.ref_name == 'next'
|
|
run: |
|
|
if [ ! -f .changeset/pre.json ]; then
|
|
echo "::warning::next branch is not in pre-release mode (promote in progress). Skipping release."
|
|
echo "skip=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Determine npm dist-tag
|
|
id: npm-tag
|
|
run: |
|
|
REF="${GITHUB_REF_NAME}"
|
|
if [[ "$REF" == "main" ]]; then
|
|
echo "tag=latest" >> "$GITHUB_OUTPUT"
|
|
elif [[ "$REF" =~ ^release/ ]]; then
|
|
# Maintenance branches publish with a version-specific tag (e.g., release-1.5)
|
|
TAG="release-${REF#release/}"
|
|
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
|
|
else
|
|
# next and other branches: changesets handles the tag via pre.json
|
|
echo "tag=" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
env:
|
|
GITHUB_REF_NAME: ${{ github.ref_name }}
|
|
|
|
- name: Create Release Pull Request or Publish
|
|
id: changesets
|
|
if: steps.guard.outputs.skip != 'true'
|
|
uses: changesets/action@c8bada60c408975afd1a20b3db81d6eee6789308 # v1
|
|
with:
|
|
version: pnpm ci:version
|
|
publish: pnpm ci:release
|
|
title: "chore: version packages"
|
|
commit: "chore: version packages"
|
|
createGithubReleases: true
|
|
env:
|
|
GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
NPM_CONFIG_TAG: ${{ steps.npm-tag.outputs.tag }}
|
|
|
|
- name: Sync main to next via PR
|
|
if: github.ref_name == 'main'
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
git fetch origin next || { echo "next branch does not exist, skipping"; exit 0; }
|
|
|
|
AHEAD=$(git rev-list --count origin/next..origin/main)
|
|
if [ "$AHEAD" -eq 0 ]; then
|
|
echo "No new commits to sync"
|
|
exit 0
|
|
fi
|
|
echo "Found $AHEAD commit(s) to sync from main to next"
|
|
|
|
EXISTING=$(gh pr list --base next --head "${GITHUB_REPOSITORY_OWNER}:main" --state open --repo "$GITHUB_REPOSITORY" --json number --jq '.[0].number // empty')
|
|
if [ -n "$EXISTING" ]; then
|
|
echo "Sync PR #$EXISTING already exists ($AHEAD commits pending)"
|
|
else
|
|
SYNC_BODY="Brings stable fixes from main into the next branch."
|
|
SYNC_BODY="$SYNC_BODY\n\n**This PR must be merged by a maintainer using 'Create a merge commit'** (not squash, not rebase). This preserves individual fix commits and their verified signatures."
|
|
SYNC_BODY="$SYNC_BODY\n\nIf there are conflicts, resolve them by keeping next's versions for \`package.json\` files (next is always ahead of main in version numbers)."
|
|
|
|
gh pr create \
|
|
--base next \
|
|
--head main \
|
|
--repo "$GITHUB_REPOSITORY" \
|
|
--title "chore: sync main to next" \
|
|
--body "$(echo -e "$SYNC_BODY")" || true
|
|
|
|
EXISTING=$(gh pr list --base next --head "${GITHUB_REPOSITORY_OWNER}:main" --state open --repo "$GITHUB_REPOSITORY" --json number --jq '.[0].number // empty')
|
|
fi
|
|
|
|
# Check for merge conflicts (GitHub computes merge state asynchronously)
|
|
if [ -n "$EXISTING" ]; then
|
|
sleep 10
|
|
for _ in 1 2 3 4 5; do
|
|
MERGEABLE=$(gh pr view "$EXISTING" --repo "$GITHUB_REPOSITORY" --json mergeable --jq '.mergeable')
|
|
[ "$MERGEABLE" != "UNKNOWN" ] && break
|
|
sleep 10
|
|
done
|
|
if [ "$MERGEABLE" = "CONFLICTING" ]; then
|
|
gh pr edit "$EXISTING" --repo "$GITHUB_REPOSITORY" --add-label "has-conflicts" || true
|
|
echo "::warning::Sync PR #$EXISTING has merge conflicts. Resolve by keeping next's versions for package.json files."
|
|
elif [ "$MERGEABLE" = "MERGEABLE" ]; then
|
|
gh pr edit "$EXISTING" --repo "$GITHUB_REPOSITORY" --remove-label "has-conflicts" 2>/dev/null || true
|
|
fi
|
|
fi
|
|
|
|
snapshot:
|
|
if: github.event_name == 'workflow_dispatch' && inputs.snapshot != '' && github.repository_owner == 'better-auth'
|
|
runs-on: ubuntu-latest
|
|
environment: Release
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
|
|
|
|
- uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
|
|
with:
|
|
node-version-file: '.nvmrc'
|
|
registry-url: 'https://registry.npmjs.org'
|
|
cache: pnpm
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- name: Version snapshot
|
|
env:
|
|
SNAPSHOT_TAG: ${{ inputs.snapshot }}
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
if [ -f .changeset/pre.json ]; then
|
|
echo "::error::Snapshots are not supported on branches in pre-release mode."
|
|
exit 1
|
|
fi
|
|
if echo "$SNAPSHOT_TAG" | grep -qE '^(latest|next|beta|rc)$'; then
|
|
echo "::error::Snapshot tag '$SNAPSHOT_TAG' conflicts with a stable dist-tag. Use a descriptive name."
|
|
exit 1
|
|
fi
|
|
pnpm changeset version --snapshot "$SNAPSHOT_TAG"
|
|
|
|
- name: Build
|
|
run: pnpm build
|
|
|
|
- name: Publish snapshot
|
|
env:
|
|
SNAPSHOT_TAG: ${{ inputs.snapshot }}
|
|
run: pnpm changeset publish --no-git-tag --tag "$SNAPSHOT_TAG"
|