José Almeida
ac3e8eeb7d
CI was failing because apps/cli/package.json declared optionalDependencies at 0.16.0 but only 0.0.0-bootstrap exists on npm for those packages. The lockfile couldn't resolve, and `pnpm install --frozen-lockfile` rejected the working tree. Pin optionalDependencies to 0.0.0-bootstrap in the committed source so the lockfile resolves cleanly. The release workflow now bumps them to the real version inside publish-npm.sh, just before publishing main kandev — at which point the matching @kdlbs/runtime-*@VERSION tarballs have already been published earlier in the same step. This avoids the chicken-and-egg where the prepare job tried to bump optional deps to a version that didn't yet exist on npm. Workflow changes: - prepare job: only bumps the main package version, not optional deps. - publish-npm.sh: rewrites optionalDependencies to $VERSION right before the main `npm publish`, after the 5 runtime packages have been published. The published kandev@X.Y.Z still has its optionalDependencies pinned to matching @kdlbs/runtime-*@X.Y.Z. Only the local source uses the bootstrap pin for development convenience.
488 lines
16 KiB
YAML
488 lines
16 KiB
YAML
name: release
|
|
|
|
# Maintainer-only release workflow.
|
|
# Trigger: GitHub Actions UI → "Run workflow" (workflow_dispatch).
|
|
#
|
|
# Flow (one click → everything below):
|
|
# 1. prepare — bump version, regen CHANGELOG, open + merge release PR, push tag vX.Y.Z
|
|
# 2. build-web — build Next.js standalone bundle
|
|
# 3. build-cli — build + esbuild-bundle CLI
|
|
# 4. build-bundles — assemble bin/ + web/ + cli/ tarballs for 5 platforms
|
|
# 5. docker — build & push multi-arch container image to GHCR
|
|
# 6. publish-release — create GH release with .tar.gz + .sha256 assets + auto-generated notes
|
|
# 7. publish-npm — publish kandev@X.Y.Z + @kdlbs/runtime-*@X.Y.Z to npmjs
|
|
# 8. update-homebrew-tap — push updated Formula/kandev.rb to kdlbs/homebrew-kandev
|
|
#
|
|
# npm publishing uses Trusted Publishers (OIDC) — no NPM_TOKEN required.
|
|
# Each package (kandev + 5 @kdlbs/runtime-* packages) must have this workflow
|
|
# configured as its trusted publisher on npmjs.com (Settings → Publishing access).
|
|
#
|
|
# Required secrets:
|
|
# HOMEBREW_TAP_DEPLOY_KEY — SSH private key for kdlbs/homebrew-kandev deploy key
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
bump:
|
|
description: "Version bump"
|
|
required: true
|
|
type: choice
|
|
default: minor
|
|
options:
|
|
- patch
|
|
- minor
|
|
- major
|
|
dry_run:
|
|
description: "Dry run (no PR, tag, npm publish, or tap update)"
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
contents: write
|
|
packages: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
prepare:
|
|
name: Prepare release (bump version, PR, tag)
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
version: ${{ steps.compute.outputs.version }}
|
|
tag: ${{ steps.compute.outputs.tag }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
with:
|
|
version: "9"
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: "24"
|
|
|
|
- name: Install git-cliff
|
|
run: |
|
|
curl -sSL "https://github.com/orhun/git-cliff/releases/download/v2.6.1/git-cliff-2.6.1-x86_64-unknown-linux-gnu.tar.gz" \
|
|
| tar -xz -C /tmp
|
|
sudo mv /tmp/git-cliff-2.6.1/git-cliff /usr/local/bin/
|
|
git-cliff --version
|
|
|
|
- name: Configure git identity
|
|
run: |
|
|
git config user.email "release-bot@kandev"
|
|
git config user.name "kandev release bot"
|
|
|
|
- name: Compute next version
|
|
id: compute
|
|
env:
|
|
BUMP: ${{ inputs.bump }}
|
|
run: |
|
|
set -euo pipefail
|
|
PKG_VERSION="$(node -p "require('./apps/cli/package.json').version")"
|
|
|
|
# Find latest git tag, normalizing legacy two-part tags (vM.m → M.m.0)
|
|
LATEST_TAG="$(git tag --list 'v*' | python3 -c "
|
|
import sys, re
|
|
best = (0, 0, 0)
|
|
for t in (l.strip() for l in sys.stdin if l.strip()):
|
|
s = t.lstrip('v')
|
|
m3 = re.match(r'^(\d+)\.(\d+)\.(\d+)$', s)
|
|
m2 = re.match(r'^(\d+)\.(\d+)$', s)
|
|
if m3:
|
|
v = tuple(int(x) for x in m3.groups())
|
|
elif m2:
|
|
v = (int(m2.group(1)), int(m2.group(2)), 0)
|
|
else:
|
|
continue
|
|
if v > best:
|
|
best = v
|
|
print(f'{best[0]}.{best[1]}.{best[2]}')
|
|
")"
|
|
|
|
# Use the higher of package.json version and the latest tag as baseline
|
|
BASELINE="$(python3 -c "
|
|
a = '$PKG_VERSION'.split('.')
|
|
b = '$LATEST_TAG'.split('.')
|
|
ai = tuple(int(x) for x in a)
|
|
bi = tuple(int(x) for x in b)
|
|
print('$PKG_VERSION' if ai >= bi else '$LATEST_TAG')
|
|
")"
|
|
|
|
IFS=. read -r MAJ MIN PAT <<<"$BASELINE"
|
|
case "$BUMP" in
|
|
patch) NEXT="${MAJ}.${MIN}.$((PAT + 1))" ;;
|
|
minor) NEXT="${MAJ}.$((MIN + 1)).0" ;;
|
|
major) NEXT="$((MAJ + 1)).0.0" ;;
|
|
*) echo "Invalid bump '$BUMP'" >&2; exit 1 ;;
|
|
esac
|
|
|
|
TAG="v${NEXT}"
|
|
echo "Current package.json version: $PKG_VERSION"
|
|
echo "Latest git tag (normalized): $LATEST_TAG"
|
|
echo "Baseline: $BASELINE"
|
|
echo "Bump: $BUMP"
|
|
echo "Next version: $NEXT"
|
|
echo "Next tag: $TAG"
|
|
echo "version=$NEXT" >> "$GITHUB_OUTPUT"
|
|
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
|
|
|
|
# Sanity: tag must not already exist
|
|
if git rev-parse "$TAG" >/dev/null 2>&1; then
|
|
echo "Tag $TAG already exists locally" >&2
|
|
exit 1
|
|
fi
|
|
if git ls-remote --tags origin "refs/tags/$TAG" | grep -q .; then
|
|
echo "Tag $TAG already exists on origin" >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Bump version
|
|
env:
|
|
NEXT: ${{ steps.compute.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
# Bump only the main version. optionalDependencies stay pinned to
|
|
# 0.0.0-bootstrap in the committed source — the publish-npm step
|
|
# rewrites them to the real version in-flight before publishing,
|
|
# once the matching @kdlbs/runtime-* tarballs actually exist on npm.
|
|
(cd apps/cli && npm version --no-git-tag-version "$NEXT")
|
|
pnpm -C apps install --no-frozen-lockfile
|
|
|
|
- name: Generate CHANGELOG
|
|
env:
|
|
TAG: ${{ steps.compute.outputs.tag }}
|
|
run: git-cliff --tag "$TAG" -o CHANGELOG.md
|
|
|
|
- name: Create release PR + merge + tag (or dry-run)
|
|
if: ${{ !inputs.dry_run }}
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
NEXT: ${{ steps.compute.outputs.version }}
|
|
TAG: ${{ steps.compute.outputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
BRANCH="release/$TAG"
|
|
MSG="release: $NEXT"
|
|
|
|
git checkout -b "$BRANCH"
|
|
git add apps/cli/package.json CHANGELOG.md apps/pnpm-lock.yaml || true
|
|
if git diff --cached --quiet; then
|
|
echo "No changes to commit; aborting." >&2
|
|
exit 1
|
|
fi
|
|
git commit -m "$MSG"
|
|
git push -u origin "$BRANCH"
|
|
|
|
PR_URL="$(gh pr create \
|
|
--title "$MSG" \
|
|
--body "Automated release: \`$NEXT\`" \
|
|
--head "$BRANCH" \
|
|
--base main)"
|
|
echo "PR: $PR_URL"
|
|
|
|
gh pr merge "$BRANCH" --squash --delete-branch --subject "$MSG" --body ""
|
|
|
|
# Pull the squashed commit into local main, then tag from it.
|
|
git fetch origin main
|
|
git checkout main
|
|
git reset --hard origin/main
|
|
git tag -a "$TAG" -m "release: $NEXT"
|
|
git push origin "$TAG"
|
|
|
|
- name: Dry-run summary
|
|
if: ${{ inputs.dry_run }}
|
|
run: |
|
|
echo "DRY RUN: Would have created PR + tag ${{ steps.compute.outputs.tag }}"
|
|
echo "DRY RUN: Would have updated CHANGELOG.md"
|
|
echo "DRY RUN: Would have bumped apps/cli/package.json to ${{ steps.compute.outputs.version }}"
|
|
|
|
build-web:
|
|
name: Build web standalone
|
|
needs: prepare
|
|
if: ${{ !inputs.dry_run }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ needs.prepare.outputs.tag }}
|
|
- uses: pnpm/action-setup@v4
|
|
with:
|
|
version: "9"
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: "24"
|
|
- name: Install dependencies
|
|
run: pnpm -C apps install --frozen-lockfile
|
|
- name: Build web (standalone)
|
|
env:
|
|
KANDEV_VERSION: ${{ needs.prepare.outputs.tag }}
|
|
run: pnpm -C apps --filter @kandev/web build
|
|
- name: Package web bundle
|
|
run: bash scripts/release/package-web.sh
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: web-bundle
|
|
path: dist/web
|
|
include-hidden-files: true
|
|
|
|
build-cli:
|
|
name: Build & bundle CLI
|
|
needs: prepare
|
|
if: ${{ !inputs.dry_run }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ needs.prepare.outputs.tag }}
|
|
- uses: pnpm/action-setup@v4
|
|
with:
|
|
version: "9"
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: "24"
|
|
- name: Install dependencies
|
|
run: pnpm -C apps install --frozen-lockfile
|
|
- name: Build and bundle CLI
|
|
run: bash scripts/release/package-cli.sh
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: cli-bundle
|
|
path: dist/kandev/cli
|
|
|
|
build-bundles:
|
|
name: Build platform bundle (${{ matrix.platform }})
|
|
needs: [build-web, build-cli]
|
|
if: ${{ !inputs.dry_run }}
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- os: ubuntu-latest
|
|
platform: linux-x64
|
|
goos: linux
|
|
goarch: amd64
|
|
- os: ubuntu-latest
|
|
platform: linux-arm64
|
|
goos: linux
|
|
goarch: arm64
|
|
cc: aarch64-linux-gnu-gcc
|
|
- os: macos-14
|
|
platform: macos-x64
|
|
goos: darwin
|
|
goarch: amd64
|
|
- os: macos-14
|
|
platform: macos-arm64
|
|
goos: darwin
|
|
goarch: arm64
|
|
- os: ubuntu-latest
|
|
platform: windows-x64
|
|
goos: windows
|
|
goarch: amd64
|
|
cc: x86_64-w64-mingw32-gcc
|
|
runs-on: ${{ matrix.os }}
|
|
env:
|
|
CGO_ENABLED: 1
|
|
GOOS: ${{ matrix.goos }}
|
|
GOARCH: ${{ matrix.goarch }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ needs.prepare.outputs.tag }}
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: apps/backend/go.mod
|
|
cache-dependency-path: apps/backend/go.sum
|
|
- uses: actions/download-artifact@v4
|
|
with:
|
|
name: web-bundle
|
|
path: dist/web
|
|
- uses: actions/download-artifact@v4
|
|
with:
|
|
name: cli-bundle
|
|
path: dist/kandev/cli
|
|
|
|
- name: Install cross-compilation tools
|
|
if: matrix.cc
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y ${{ matrix.cc == 'aarch64-linux-gnu-gcc' && 'gcc-aarch64-linux-gnu' || 'gcc-mingw-w64-x86-64' }}
|
|
|
|
- name: Build backend binaries
|
|
env:
|
|
CC: ${{ matrix.cc || '' }}
|
|
run: |
|
|
cd apps/backend
|
|
mkdir -p bin
|
|
EXT=${{ matrix.goos == 'windows' && '.exe' || '' }}
|
|
go build -o bin/kandev${EXT} ./cmd/kandev
|
|
go build -o bin/agentctl${EXT} ./cmd/agentctl
|
|
|
|
- name: Package bundle
|
|
run: |
|
|
rm -rf dist/kandev/bin dist/kandev/web
|
|
mkdir -p dist/kandev/bin
|
|
EXT=${{ matrix.goos == 'windows' && '.exe' || '' }}
|
|
cp apps/backend/bin/kandev${EXT} dist/kandev/bin/
|
|
cp apps/backend/bin/agentctl${EXT} dist/kandev/bin/
|
|
mkdir -p dist/kandev/web
|
|
cp -R dist/web/. dist/kandev/web/
|
|
# cli/ was already placed by the build-cli job (downloaded above)
|
|
cd dist
|
|
tar -czf "kandev-${{ matrix.platform }}.tar.gz" kandev
|
|
shasum -a 256 "kandev-${{ matrix.platform }}.tar.gz" > "kandev-${{ matrix.platform }}.tar.gz.sha256"
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: bundle-${{ matrix.platform }}
|
|
path: |
|
|
dist/kandev-${{ matrix.platform }}.tar.gz
|
|
dist/kandev-${{ matrix.platform }}.tar.gz.sha256
|
|
|
|
docker:
|
|
name: Build & push container image
|
|
needs: prepare
|
|
if: ${{ !inputs.dry_run }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ needs.prepare.outputs.tag }}
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ghcr.io/kdlbs/kandev
|
|
tags: |
|
|
type=raw,value=${{ needs.prepare.outputs.version }}
|
|
type=raw,value=${{ needs.prepare.outputs.tag }}
|
|
type=sha
|
|
type=raw,value=latest
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Login to GHCR
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
push: true
|
|
platforms: linux/amd64,linux/arm64
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
|
|
publish-release:
|
|
name: Publish GitHub release
|
|
needs: [prepare, build-bundles]
|
|
if: ${{ !inputs.dry_run }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ needs.prepare.outputs.tag }}
|
|
fetch-depth: 0
|
|
|
|
- name: Generate release notes
|
|
uses: orhun/git-cliff-action@v4
|
|
with:
|
|
config: cliff.toml
|
|
args: --latest --strip header
|
|
env:
|
|
OUTPUT: RELEASE_NOTES.md
|
|
|
|
- uses: actions/download-artifact@v4
|
|
with:
|
|
pattern: bundle-*
|
|
path: dist/release-assets
|
|
merge-multiple: true
|
|
|
|
- name: Verify release assets
|
|
run: |
|
|
set -euo pipefail
|
|
required_platforms=(linux-x64 linux-arm64 macos-x64 macos-arm64 windows-x64)
|
|
for platform in "${required_platforms[@]}"; do
|
|
archive="dist/release-assets/kandev-${platform}.tar.gz"
|
|
checksum="${archive}.sha256"
|
|
if [ ! -f "$archive" ]; then
|
|
echo "Missing required archive: $archive" >&2
|
|
exit 1
|
|
fi
|
|
if [ ! -f "$checksum" ]; then
|
|
echo "Missing required checksum: $checksum" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
ls -lh dist/release-assets
|
|
|
|
- name: Publish release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
tag_name: ${{ needs.prepare.outputs.tag }}
|
|
name: ${{ needs.prepare.outputs.tag }}
|
|
body_path: RELEASE_NOTES.md
|
|
files: |
|
|
dist/release-assets/kandev-*.tar.gz
|
|
dist/release-assets/kandev-*.tar.gz.sha256
|
|
|
|
publish-npm:
|
|
name: Publish npm packages
|
|
needs: [prepare, publish-release]
|
|
if: ${{ !inputs.dry_run }}
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write # Required for OIDC trusted publishing
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ needs.prepare.outputs.tag }}
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
with:
|
|
version: "9"
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: "24"
|
|
registry-url: "https://registry.npmjs.org"
|
|
|
|
- name: Install dependencies
|
|
run: pnpm -C apps install --frozen-lockfile
|
|
|
|
- name: Publish npm packages
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
bash scripts/release/publish-npm.sh \
|
|
"${{ needs.prepare.outputs.version }}" \
|
|
"${{ needs.prepare.outputs.tag }}"
|
|
|
|
update-homebrew-tap:
|
|
name: Update Homebrew tap
|
|
needs: [prepare, publish-release]
|
|
if: ${{ !inputs.dry_run }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ needs.prepare.outputs.tag }}
|
|
|
|
- name: Update Homebrew tap formula
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
HOMEBREW_TAP_DEPLOY_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
|
|
run: |
|
|
bash scripts/release/update-homebrew-tap.sh \
|
|
"${{ needs.prepare.outputs.version }}" \
|
|
"${{ needs.prepare.outputs.tag }}"
|