Release #83
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Manual-only: pick the bump from the Actions UI, or | |
| # gh workflow run release.yml -f version_bump=patch|minor|major | |
| # No daily schedule on purpose. A timed cron auto-published unwanted releases on | |
| # the WordPress plugin, so a spec change here never publishes without review. | |
| # repository_dispatch (openapi-updated) is reserved for the planned main-app | |
| # integration; keep it off until the manual pipeline is proven. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version_bump: | |
| description: 'patch | minor | major' | |
| required: false | |
| default: 'patch' | |
| # repository_dispatch: | |
| # types: [openapi-updated] | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write | |
| outputs: | |
| version: ${{ steps.bump.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: '24' | |
| registry-url: 'https://registry.npmjs.org' | |
| - uses: oven-sh/setup-bun@v2 | |
| - run: bun install --frozen-lockfile | |
| # Trusted publishing (OIDC) CANNOT create a package. npmjs.com requires the | |
| # package to already exist before a Trusted Publisher can be configured on it, | |
| # so the first version of any new package must be pushed by a human once | |
| # (npm/cli#8544, still open). | |
| # | |
| # Without this gate the run would publish @roxyapi/ui and @roxyapi/ui-react, | |
| # THEN die on the first-ever @roxyapi/ui-vue publish. The job aborts before | |
| # "Commit, tag, push", so npm ends up bumped while the repo has no version | |
| # commit, no tag and no GitHub release, and the re-run is then rejected for | |
| # republishing an existing version. Fail BEFORE anything is published instead. | |
| - name: Preflight — every package must already exist on npm | |
| run: | | |
| MISSING="" | |
| for pkg in packages/ui packages/ui-react packages/ui-vue; do | |
| NAME=$(jq -r '.name' "$pkg/package.json") | |
| npm view "$NAME" version >/dev/null 2>&1 || MISSING="$MISSING $NAME" | |
| done | |
| if [ -n "$MISSING" ]; then | |
| echo "::error::Never published, so OIDC cannot publish it either:$MISSING" | |
| echo "Bootstrap each package ONCE from a logged-in machine:" | |
| echo " (cd packages/<name> && npm publish --access public)" | |
| echo "then on npmjs.com open the package and set" | |
| echo " Trusted Publisher -> GitHub Actions -> RoxyAPI/ui -> release.yml" | |
| echo "Re-run this workflow afterwards. See npm/cli#8544." | |
| exit 1 | |
| fi | |
| echo "All packages exist on npm. Trusted publishing can proceed." | |
| - name: Regenerate types from spec | |
| run: bun run generate | |
| # The human-review barrier for a manual-publish repo: block the release when the committed | |
| # spec is behind live, so a spec refresh always lands in a reviewed commit before it ships. | |
| # `packages/ui/src/types` is gitignored and therefore cannot be asserted here. | |
| - name: Spec drift gate (committed spec must already match live) | |
| run: | | |
| git diff --exit-code -- specs/openapi.json \ | |
| || { echo "::error::specs/openapi.json is behind the live API. Run 'bun run generate', commit the refresh, then release."; exit 1; } | |
| - name: Sync docs from spec | |
| run: bun run docs:sync | |
| - name: Lint | |
| run: bun run check | |
| - name: Typecheck | |
| run: bun run typecheck | |
| - name: Build | |
| run: bun run build | |
| - name: Unit tests | |
| run: bun run test | |
| - name: Provision Playwright browsers from MCR image (bypass cdn.playwright.dev) | |
| # cdn.playwright.dev browser-binary downloads stall from GitHub runners | |
| # (the binaries never finish, hanging the job). Pull the exact matching | |
| # browsers from the official Playwright image on Microsoft Container | |
| # Registry instead, then copy them into the default browser cache. | |
| # install-deps is apt-only (no CDN download). Keep the image tag in | |
| # lockstep with @playwright/test in package.json (currently 1.61.1). | |
| run: | | |
| bunx playwright install-deps | |
| docker create --name pwbrowsers mcr.microsoft.com/playwright:v1.61.1-noble | |
| mkdir -p "$HOME/.cache/ms-playwright" | |
| docker cp pwbrowsers:/ms-playwright/. "$HOME/.cache/ms-playwright/" | |
| docker rm pwbrowsers | |
| ls -1 "$HOME/.cache/ms-playwright" | |
| - name: E2E tests | |
| run: bun run test:e2e | |
| - name: UI audit (no [object Object], no empty-state drift) | |
| run: | | |
| bun run preview & | |
| PREVIEW_PID=$! | |
| for i in $(seq 1 30); do | |
| curl -sf http://localhost:3001 > /dev/null && break | |
| sleep 1 | |
| done | |
| bun run audit | |
| AUDIT_EXIT=$? | |
| kill $PREVIEW_PID 2>/dev/null || true | |
| exit $AUDIT_EXIT | |
| - name: Bump versions and rebuild | |
| id: bump | |
| run: | | |
| BUMP="${{ github.event.inputs.version_bump || 'patch' }}" | |
| bump() { | |
| local file="$1/package.json" | |
| local current new | |
| current=$(jq -r '.version' "$file") | |
| IFS='.' read -r MA MI PA <<< "$current" | |
| case "$BUMP" in | |
| major) MA=$((MA+1)); MI=0; PA=0 ;; | |
| minor) MI=$((MI+1)); PA=0 ;; | |
| *) PA=$((PA+1)) ;; | |
| esac | |
| new="$MA.$MI.$PA" | |
| jq --arg v "$new" '.version = $v' "$file" > "$file.tmp" && mv "$file.tmp" "$file" | |
| echo "$1 -> $new" | |
| } | |
| bump packages/ui | |
| bump packages/ui-react | |
| bump packages/ui-vue | |
| VERSION=$(jq -r '.version' packages/ui/package.json) | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| bun run build | |
| # ORDER IS LOAD-BEARING: least-proven package FIRST. | |
| # | |
| # npm publishes cannot be rolled back, so a publish that dies halfway leaves | |
| # npm bumped while the repo has no version commit, no tag and no release, and | |
| # the re-run is then rejected for republishing an existing version. The | |
| # preflight above proves each package EXISTS, but it cannot prove a Trusted | |
| # Publisher is configured on it — a package can exist and still reject OIDC. | |
| # | |
| # Publishing the newest package first turns that unverifiable risk into a safe | |
| # failure: if its trust config is missing, the job dies before the established | |
| # packages are touched and nothing is published at all. Whenever a new wrapper | |
| # package is added, move it to the top of this list until it has shipped once. | |
| - name: Publish @roxyapi/ui-vue | |
| run: | | |
| npm install -g npm@latest | |
| (cd packages/ui-vue && npm publish --access public --provenance) | |
| - name: Publish @roxyapi/ui | |
| run: | | |
| (cd packages/ui && npm publish --access public --provenance) | |
| - name: Publish @roxyapi/ui-react | |
| run: | | |
| (cd packages/ui-react && npm publish --access public --provenance) | |
| - name: Commit, tag, push | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| VERSION=$(node -p "require('./packages/ui/package.json').version") | |
| # dist/ is gitignored: npm publish (above) already shipped it via the | |
| # package.json `files` allowlist. Commit only source, version bumps, | |
| # and the committed codegen (registry, manifest, docs tables). | |
| git add packages/ registry/ apps/docs/manifest.js README.md AGENTS.md | |
| git commit -m "release: v$VERSION" | |
| # These two lines are INERT and the tag you see on the remote is not from here. | |
| # `git tag` makes a LIGHTWEIGHT tag and `git push --follow-tags` pushes only | |
| # ANNOTATED ones, so this pushes the commit and silently drops the tag. Tagging | |
| # actually happens server-side in the `action-gh-release` step below, via | |
| # `tag_name`, which is why every tag on this remote is lightweight (no `^{}` | |
| # dereference line in `git ls-remote --tags`). Confirmed after the same | |
| # two lines were found losing every tag in a sibling repo that has no Release step. | |
| # So do NOT remove `action-gh-release` or replace it with a plain `git push` | |
| # believing this covers tagging. Cleanup tracked; not touched on a release day. | |
| git tag "v$VERSION" | |
| git push --follow-tags | |
| # The Pages demo is deployed from THIS run, by the deploy-pages job below. | |
| # It cannot be left to pages.yml: the `release: [published]` trigger there | |
| # has never once fired, because GitHub does not start a workflow | |
| # from an event created with the default GITHUB_TOKEN, and both the | |
| # `release: vX` push and the GitHub Release here use exactly that token. | |
| # The demo therefore sat one commit behind every release. `apps/docs` | |
| # already holds the post-bump build from the "Bump versions and rebuild" | |
| # step, so this uploads the correct artifact with no extra build. | |
| - name: Upload Pages artifact | |
| uses: actions/upload-pages-artifact@v5 | |
| with: | |
| path: apps/docs | |
| - name: Pack npm tarballs for release assets | |
| run: | | |
| mkdir -p .release-assets | |
| (cd packages/ui && npm pack --pack-destination ../../.release-assets) | |
| (cd packages/ui-react && npm pack --pack-destination ../../.release-assets) | |
| (cd packages/ui-vue && npm pack --pack-destination ../../.release-assets) | |
| ls -la .release-assets/ | |
| - name: Create GitHub release | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: v${{ steps.bump.outputs.version }} | |
| generate_release_notes: true | |
| make_latest: 'true' | |
| files: | | |
| .release-assets/*.tgz | |
| # Deliberately a SEPARATE job. `actions/deploy-pages` requires the | |
| # `github-pages` environment, and an `environment:` on the release job would | |
| # add an `environment` claim to its OIDC token. The npm Trusted Publishers for | |
| # all three packages were configured WITHOUT an environment, so inlining this | |
| # would fail every publish. Keeping it behind `needs:` leaves those claims | |
| # byte-identical. | |
| deploy-pages: | |
| needs: release | |
| if: needs.release.outputs.version != '' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pages: write | |
| id-token: write | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| # Same group as pages.yml so a release deploy and a push deploy serialize | |
| # instead of racing. Not cancel-in-progress: a half-applied deploy is worse | |
| # than a slow one. | |
| concurrency: | |
| group: pages | |
| cancel-in-progress: false | |
| steps: | |
| - id: deployment | |
| uses: actions/deploy-pages@v5 | |
| # Publishing to npm is NOT shipping. `@latest` resolves per FILE, so a release can go | |
| # half-live and stay that way silently: the CDN can still serve the bundle at an older | |
| # version while the locale catalogues have already moved, which leaves a hosted embed | |
| # running code older than the strings it loads. npm reads correct throughout and nothing | |
| # errors, so the purge is automated rather than left to a hand-typed step. | |
| # | |
| # It is a SEPARATE JOB, and deliberately not a step at the end of `release`. The purge can | |
| # only run after `npm publish`, but a CDN hiccup must never strand the release: as a step | |
| # it would fail before "Commit, tag, push", leaving the packages published with no git | |
| # tag, no GitHub Release and no Pages deploy, which is strictly worse than the stale CDN | |
| # it exists to prevent. Behind `needs: release` every one of those has already happened, | |
| # so a failure here means exactly one thing, says so loudly, and is fixed by re-running | |
| # this job alone. The script is idempotent. | |
| verify-cdn: | |
| needs: release | |
| if: needs.release.outputs.version != '' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| # No `bun install` and no build. The script talks to the CDN over plain fetch and | |
| # derives its asset list from the built manifest plus the theme filenames, both of | |
| # which are produced by the release job. It reads them from the checkout, so the | |
| # locale and theme lists are whatever that version actually shipped. | |
| - name: Purge jsDelivr and verify the edge actually flipped | |
| run: bun run purge:cdn ${{ needs.release.outputs.version }} |