chore(release): bump to 8.0.0-rc.5 (#207) #63
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to npm | |
| # Every run publishes a dev build. A run also publishes a release when | |
| # the push changed the root `version`, or a dispatch asked for one. The | |
| # two are not alternatives: when they were, the release commit never | |
| # reached the dev channel and `dev` sat on an older version than the | |
| # release. See docs/oss/versioning.md. | |
| # | |
| # The version is always what the root `package.json` says at this ref. | |
| # Dev suffixes are stamped in CI and never committed. | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["!**"] | |
| workflow_dispatch: | |
| inputs: | |
| dist-tag: | |
| description: "npm dist-tag. Empty = the version's canonical tag (next on the RC line, latest for stable). Pass latest explicitly to move latest onto an RC — that is the deliberate cutover act." | |
| required: false | |
| default: "" | |
| type: string | |
| dry-run: | |
| description: "Dry-run only (build + pack, no npm publish, no GitHub Release)." | |
| required: false | |
| default: true | |
| type: boolean | |
| concurrency: | |
| group: npm-publish | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| name: Publish packages to npm | |
| runs-on: ubuntu-latest | |
| # Only `main` publishes; a dry-run dispatch may validate the pipeline | |
| # from any branch. | |
| if: ${{ github.ref == 'refs/heads/main' || (github.event_name == 'workflow_dispatch' && github.event.inputs.dry-run == 'true') }} | |
| permissions: | |
| contents: write # Required to create the GitHub Release + tag for latest publishes | |
| id-token: write # Required for npm OIDC Trusted Publishing | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| # determine-version.ts reads package.json at `before`, which a | |
| # multi-commit push can place arbitrarily far back. | |
| fetch-depth: 0 | |
| - name: Set up pnpm | |
| uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version-file: .node-version | |
| cache: pnpm | |
| - name: Configure npm | |
| run: pnpm config set registry https://registry.npmjs.org | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Determine version | |
| id: version | |
| env: | |
| GITHUB_EVENT_NAME: ${{ github.event_name }} | |
| INPUT_DIST_TAG: ${{ github.event.inputs.dist-tag }} | |
| PUSH_BEFORE_SHA: ${{ github.event.before }} | |
| run: node scripts/determine-version.ts | |
| # --- The dev build: every run, no conditions. --- | |
| # The lockfile refresh is part of the stamp: pnpm verifies | |
| # manifests against the lockfile before running any script. | |
| - name: Stamp the dev version | |
| env: | |
| DEV_VERSION: ${{ steps.version.outputs.devVersion }} | |
| run: | | |
| node scripts/set-version.ts "$DEV_VERSION" | |
| node scripts/update-product-versions.mjs --channel dev | |
| pnpm install --lockfile-only --no-frozen-lockfile | |
| - name: Build the dev version | |
| run: pnpm build | |
| - name: Check the dev version | |
| env: | |
| PUBLISH_CHANNEL: dev | |
| run: | | |
| pnpm check:grammar | |
| pnpm test:scripts | |
| pnpm check:conformance | |
| - name: Publish the dev version | |
| if: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.dry-run != 'true' }} | |
| env: | |
| NPM_CONFIG_PROVENANCE: "true" | |
| run: bash scripts/publish-packages.sh dev @prisma/cli-engine @prisma/cli prisma | |
| - name: Verify the dev version resolves | |
| if: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.dry-run != 'true' }} | |
| env: | |
| DEV_VERSION: ${{ steps.version.outputs.devVersion }} | |
| run: | | |
| node scripts/verify-published.mjs "@prisma/cli@$DEV_VERSION" "prisma@$DEV_VERSION" | |
| # --- The release: only when the committed version changed. --- | |
| - name: Restore the committed versions | |
| if: ${{ steps.version.outputs.release == 'true' }} | |
| run: | | |
| git checkout -- . | |
| pnpm install --frozen-lockfile | |
| pnpm build | |
| - name: Check the release | |
| if: ${{ steps.version.outputs.release == 'true' }} | |
| env: | |
| PUBLISH_CHANNEL: release | |
| run: | | |
| pnpm check:grammar | |
| pnpm check:conformance | |
| - name: Upload tarball artifacts | |
| if: ${{ steps.version.outputs.release == 'true' }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: npm-tarballs | |
| path: artifacts/tarballs/*.tgz | |
| if-no-files-found: error | |
| # NODE_AUTH_TOKEN is intentionally NOT set: npm authenticates over | |
| # OIDC, and setting it to any value — even empty — blocks that. | |
| # `pnpm publish`, not `npm publish`, or `workspace:` specifiers | |
| # survive into the published manifest. | |
| - name: Publish the release | |
| if: ${{ steps.version.outputs.release == 'true' && (github.event_name != 'workflow_dispatch' || github.event.inputs.dry-run != 'true') }} | |
| env: | |
| NPM_CONFIG_PROVENANCE: "true" | |
| DIST_TAG: ${{ steps.version.outputs.releaseTag }} | |
| run: bash scripts/publish-packages.sh "$DIST_TAG" @prisma/cli-engine @prisma/cli prisma | |
| - name: Verify the release resolves | |
| if: ${{ steps.version.outputs.release == 'true' && (github.event_name != 'workflow_dispatch' || github.event.inputs.dry-run != 'true') }} | |
| env: | |
| RELEASE_VERSION: ${{ steps.version.outputs.releaseVersion }} | |
| run: | | |
| engine=$(node -p "require('./packages/cli-engine/package.json').version") | |
| node scripts/verify-published.mjs \ | |
| "@prisma/cli-engine@$engine" \ | |
| "@prisma/cli@$RELEASE_VERSION" \ | |
| "prisma@$RELEASE_VERSION" | |
| # Draft first, assets, then publish: a published release is | |
| # immutable, so a later upload answers 422. Created through the API | |
| # for the id — searching the releases listing for a draft races its | |
| # eventual consistency. | |
| - name: Create GitHub Release | |
| if: ${{ steps.version.outputs.githubRelease == 'true' && (github.event_name != 'workflow_dispatch' || github.event.inputs.dry-run != 'true') }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| VERSION: ${{ steps.version.outputs.releaseVersion }} | |
| run: | | |
| # The by-tag endpoints do not see drafts, so search the listing. | |
| existing=$(gh api --paginate "repos/$GITHUB_REPOSITORY/releases" \ | |
| | jq -c --arg tag "v$VERSION" '.[] | select(.tag_name == $tag)' | head -n 1) | |
| if [ -n "$existing" ]; then | |
| if [ "$(jq -r .draft <<<"$existing")" = "false" ]; then | |
| echo "Release v$VERSION is already published and releases are immutable — nothing to repair." | |
| exit 0 | |
| fi | |
| # A draft from a failed attempt never reached anyone; replace it. | |
| gh api -X DELETE "repos/$GITHUB_REPOSITORY/releases/$(jq -r .id <<<"$existing")" | |
| fi | |
| PRERELEASE=false | |
| case "$VERSION" in | |
| *-rc.*) PRERELEASE=true ;; | |
| esac | |
| release_id=$(gh api "repos/$GITHUB_REPOSITORY/releases" \ | |
| -f tag_name="v$VERSION" \ | |
| -f target_commitish="$GITHUB_SHA" \ | |
| -f name="v$VERSION" \ | |
| -F draft=true \ | |
| -F prerelease=$PRERELEASE \ | |
| -F generate_release_notes=true \ | |
| --jq .id) | |
| if [ -z "$release_id" ]; then | |
| echo "Creating the draft release for v$VERSION returned no id" >&2 | |
| exit 1 | |
| fi | |
| # By id, not tag: uploads to a fresh draft race the by-tag lookup. | |
| for tarball in artifacts/tarballs/*.tgz; do | |
| gh api -X POST \ | |
| -H "Content-Type: application/gzip" \ | |
| "https://uploads.github.com/repos/$GITHUB_REPOSITORY/releases/$release_id/assets?name=$(basename "$tarball")" \ | |
| --input "$tarball" >/dev/null | |
| done | |
| gh api -X PATCH "repos/$GITHUB_REPOSITORY/releases/$release_id" \ | |
| -F draft=false >/dev/null | |
| echo "Published release v$VERSION with $(find artifacts/tarballs -name '*.tgz' | wc -l | tr -d ' ') asset(s)." |