release.yml

name: Release
run-name: >-
  ${{
    github.event_name == 'issue_comment'
      && format('[Snapshot] Request by {0}', github.actor)
    || github.event_name == 'workflow_dispatch'
      && format('[Snapshot] Release by {0}', inputs.requester)
    || contains(github.event.head_commit.message, 'Version packages')
      && format('[Production] Release from {0}', github.ref_name)
    || format('[Canary] Release from {0}', github.ref_name)
  }}

on:
  push:
    branches:
      - main
  issue_comment:
    types: [created]
  workflow_dispatch:
    inputs:
      snapshot_name:
        description: Snapshot tag name (lowercase letters and hyphens); defaults to "snapshot"
        type: string
        default: ''
      pr_number:
        description: Pull request number the snapshot was requested from
        type: string
        required: true
      head_sha:
        description: Commit the snapshot request was validated against
        type: string
        required: true
      comment_id:
        description: ID of the !snapshot comment
        type: string
        required: true
      requester:
        description: GitHub login of the person who requested the snapshot
        type: string
        required: true

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'issue_comment' && format('issue-{0}-{1}', github.event.issue.number, github.actor) || github.event_name == 'workflow_dispatch' && format('snapshot-{0}-{1}', inputs.pr_number, inputs.requester) || github.ref }}
  cancel-in-progress: true

jobs:
  release:
    name: Release
    if: ${{ github.event_name == 'push' && github.repository == 'clerk/javascript' }}
    runs-on: ${{ vars.RUNNER_NORMAL || 'ubuntu-latest' }}
    timeout-minutes: 40

    permissions:
      actions: read
      contents: write
      id-token: write
      packages: write
      pull-requests: write
      issues: read
      statuses: write
      checks: write

    steps:
      - name: Echo github context
        run: echo "$GITHUB_CONTEXT"
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}

      - name: Checkout repo
        uses: actions/checkout@v4.4.0
        with:
          fetch-depth: 0
          show-progress: false
          # Use the PAT so pushes from `changesets/action` are authored by
          # clerk-cookie. With the default GITHUB_TOKEN, GitHub suppresses
          # the resulting `synchronize` events and CI never runs on Release
          # PR updates — forcing a manual close/reopen to re-trigger.
          token: ${{ secrets.CLERK_COOKIE_PAT }}

      - name: Setup
        id: config
        uses: $/.github/actions/init
        with:
          cache-enabled: false # OIDC publish job; do not restore poisonable cache state.
          turbo-enabled: false # Release uses --force, so turbo cache is not needed
          turbo-team: ""
          turbo-token: ""

      - name: Upgrade npm for trusted publishing
        run: npx npm@11 install -g npm@11

      - name: Determine whether electron-passkeys is about to publish
        id: detect-native
        run: node scripts/detect-electron-passkeys-publish.mjs >> "$GITHUB_OUTPUT"

      - name: Build release
        run: pnpm turbo build $TURBO_ARGS --force

      - name: Download electron-passkeys native binaries
        if: ${{ steps.detect-native.outputs.should-build == 'true' }}
        uses: dawidd6/action-download-artifact@v21
        with:
          github_token: ${{ github.token }}
          workflow: electron-passkeys.yml
          name: electron-passkeys-npm
          path: packages/electron-passkeys/npm
          branch: ${{ github.ref_name }}
          event: workflow_dispatch
          workflow_conclusion: success
          search_artifacts: true
          allow_forks: false

      - name: Verify electron-passkeys binaries are present
        if: ${{ steps.detect-native.outputs.should-build == 'true' }}
        run: node scripts/check-electron-passkeys-binaries.mjs packages/electron-passkeys/npm

      - name: Create Release PR
        id: changesets
        uses: changesets/action@v1.8.0
        with:
          commit: "ci(repo): Version packages"
          title: "ci(repo): Version packages"
          publish: pnpm release
          # Workaround for https://github.com/changesets/changesets/issues/421
          version: pnpm version-packages
        env:
          GITHUB_TOKEN: ${{ secrets.CLERK_COOKIE_PAT }}
          HUSKY: "0"
          NPM_CONFIG_PROVENANCE: true

      - name: Trigger workflows on related repos
        if: steps.changesets.outputs.published == 'true'
        uses: actions/github-script@v7.1.0
        with:
          result-encoding: string
          retries: 3
          retry-exempt-status-codes: 400,401
          github-token: ${{ secrets.CLERK_COOKIE_PAT }}
          script: |
            const preMode = require("fs").existsSync("./.changeset/pre.json");
            if (!preMode) {
              const clerkjsVersion = require('./packages/clerk-js/package.json').version;
              const clerkUiVersion = require('./packages/ui/package.json').version;
              const nextjsVersion = require('./packages/nextjs/package.json').version;

              // NOTE: Keep in sync with the `targets` array in the "Recover downstream notifications" step below.
              const targets = [
                { repo: 'sdk-infra-workers', workflow_id: 'update-pkg-versions.yml', inputs: { clerkjsVersion, clerkUiVersion } },
                { repo: 'dashboard', workflow_id: 'prepare-nextjs-sdk-update.yml', inputs: { version: nextjsVersion } },
                { repo: 'clerk', workflow_id: 'docs-typedoc.yml', inputs: { javascript_ref: context.sha }, critical: true },
              ];
              const results = await Promise.allSettled(
                targets.map(({ repo, workflow_id, inputs }) =>
                  github.rest.actions.createWorkflowDispatch({ owner: 'clerk', repo, workflow_id, ref: 'main', inputs })
                )
              );
              const failures = results
                .map((r, i) => r.status === 'rejected' ? { target: targets[i], reason: r.reason } : null)
                .filter(Boolean);
              if (failures.length) {
                failures.forEach(f => {
                  const message = `Dispatch to ${f.target.repo}/${f.target.workflow_id} failed: ${f.reason?.message ?? f.reason}`;
                  if (f.target.critical) {
                    core.setFailed(message);
                  } else {
                    core.warning(message);
                  }
                });
              }
            } else{
              core.warning("Changeset in pre-mode should not prepare a ClerkJS production release")
            }

      # Recovery: if the changesets action published to npm but then failed
      # (e.g. git push --follow-tags error), the `published` output is never
      # set and downstream repos are not notified. This step detects that
      # scenario by checking npm for the local package version and dispatches
      # if the packages are already live.
      - name: Recover downstream notifications
        if: always() && steps.changesets.conclusion == 'failure'
        uses: actions/github-script@v7.1.0
        with:
          result-encoding: string
          retries: 3
          retry-exempt-status-codes: 400,401
          github-token: ${{ secrets.CLERK_COOKIE_PAT }}
          script: |
            const { execSync } = require('child_process');

            const clerkjsVersion = require('./packages/clerk-js/package.json').version;
            const clerkUiVersion = require('./packages/ui/package.json').version;

            // Only recover stable releases
            const preReleases = [
              clerkjsVersion.includes('-') && `@clerk/clerk-js@${clerkjsVersion}`,
              clerkUiVersion.includes('-') && `@clerk/ui@${clerkUiVersion}`,
            ].filter(Boolean);
            if (preReleases.length > 0) {
              console.log(`Skipping recovery: ${preReleases.join(', ')} is a pre-release`);
              return;
            }

            const preMode = require("fs").existsSync("./.changeset/pre.json");
            if (preMode) {
              core.warning("Changeset in pre-mode, skipping recovery dispatch");
              return;
            }

            // Check if either version was actually published to npm
            function isPublished(name, version) {
              try {
                return execSync(`npm view ${name}@${version} version`, { encoding: 'utf8' }).trim() === version;
              } catch (e) {
                console.log(`npm view ${name}@${version} failed: ${e.message}`);
                return false;
              }
            }

            const clerkjsPublished = isPublished('@clerk/clerk-js', clerkjsVersion);
            const clerkUiPublished = isPublished('@clerk/ui', clerkUiVersion);

            if (!clerkjsPublished && !clerkUiPublished) {
              console.log('Neither @clerk/clerk-js nor @clerk/ui were published to npm, no recovery needed');
              return;
            }

            const published = [
              clerkjsPublished && `@clerk/clerk-js@${clerkjsVersion}`,
              clerkUiPublished && `@clerk/ui@${clerkUiVersion}`,
            ].filter(Boolean).join(', ');
            core.warning(`Recovery: ${published} published to npm but downstream repos were not notified. Dispatching now.`);

            const nextjsVersion = require('./packages/nextjs/package.json').version;

            // NOTE: Keep in sync with the `targets` array in the "Trigger workflows on related repos" step above.
            const targets = [
              { repo: 'sdk-infra-workers', workflow_id: 'update-pkg-versions.yml', inputs: { clerkjsVersion, clerkUiVersion } },
              { repo: 'dashboard', workflow_id: 'prepare-nextjs-sdk-update.yml', inputs: { version: nextjsVersion } },
              { repo: 'clerk', workflow_id: 'docs-typedoc.yml', inputs: { javascript_ref: context.sha }, critical: true },
            ];
            const results = await Promise.allSettled(
              targets.map(({ repo, workflow_id, inputs }) =>
                github.rest.actions.createWorkflowDispatch({ owner: 'clerk', repo, workflow_id, ref: 'main', inputs })
              )
            );
            const failures = results
              .map((r, i) => r.status === 'rejected' ? { target: targets[i], reason: r.reason } : null)
              .filter(Boolean);
            if (failures.length) {
              failures.forEach(f => {
                const message = `Recovery dispatch to ${f.target.repo}/${f.target.workflow_id} failed: ${f.reason?.message ?? f.reason}`;
                if (f.target.critical) {
                  core.setFailed(message);
                } else {
                  core.warning(message);
                }
              });
            } else {
              core.notice('Recovery dispatch completed successfully');
            }

      - name: Generate notification payload
        id: notification
        if: ${{ !cancelled() && steps.changesets.outputs.published == 'true' }}
        env:
          PUBLISHED_PACKAGES: ${{ steps.changesets.outputs.publishedPackages }}
          GH_ACTOR: ${{ github.actor }}
        run: |
          payload="$(node scripts/notify.mjs "$PUBLISHED_PACKAGES" "$GH_ACTOR")"
          {
            echo 'payload<<__NOTIFY_EOF__'
            echo "$payload"
            echo '__NOTIFY_EOF__'
          } >> "$GITHUB_OUTPUT"

      - name: Send commit log to Slack
        id: slack
        if: ${{ !cancelled() && steps.changesets.outputs.published == 'true' && steps.notification.outcome == 'success' }}
        uses: slackapi/slack-github-action@v1.27.1
        with:
          payload: ${{ steps.notification.outputs.payload }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CHANGELOG_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

      - name: Generate Expo release payload
        id: expo-release
        if: ${{ !cancelled() && steps.changesets.outputs.published == 'true' }}
        env:
          PUBLISHED_PACKAGES: ${{ steps.changesets.outputs.publishedPackages }}
          GH_TOKEN: ${{ github.token }}
        run: |
          release_pr="$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls" \
            --jq '[.[] | select(.head.ref == "changeset-release/main")][0].html_url // ""')" || release_pr=""
          payload="$(jq -c --arg repo "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" --arg release_pr "$release_pr" '
            first(.[] | select(.name == "@clerk/expo"))
            | "Clerk Expo SDK \(.version) has been released" as $title
            | "\(.name)@\(.version)" as $tag
            | "<\($repo)/releases/tag/\($tag | @uri | gsub("%2F"; "/"))|View the GitHub release>" as $release_link
            | {
                text: $title,
                blocks: [
                  { type: "section", text: { type: "mrkdwn", text: "*\($title)*" } },
                  { type: "context", elements: [ { type: "mrkdwn", text: (if $release_pr == "" then $release_link else "\($release_link) · <\($release_pr)|View the changeset release PR>" end) } ] }
                ]
              }
          ' <<<"$PUBLISHED_PACKAGES")"
          if [ -z "$payload" ]; then
            echo "@clerk/expo was not published in this release."
            exit 0
          fi
          echo "$payload"
          {
            echo 'payload<<__NOTIFY_EOF__'
            echo "$payload"
            echo '__NOTIFY_EOF__'
          } >> "$GITHUB_OUTPUT"

      - name: Send Expo release to Slack
        if: ${{ !cancelled() && steps.changesets.outputs.published == 'true' && steps.expo-release.outputs.payload != '' }}
        continue-on-error: true
        uses: slackapi/slack-github-action@v1.27.1
        with:
          payload: ${{ steps.expo-release.outputs.payload }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_MOBILE_TEAM_ALERTS_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

      - name: Notify Slack on failure
        if: ${{ always() && steps.changesets.outcome == 'failure' }}
        uses: slackapi/slack-github-action@v1.27.1
        with:
          payload: |
            {
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*:red_circle: Stable release failed*\n*Repo:* `${{ github.repository }}`\n*Workflow:* `${{ github.workflow }}`\n*Commit:* `${{ github.sha }}`\n*Triggered by:* `${{ github.actor }}`\n*Run:* <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SDK_SLACKER_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

  canary-release:
    name: Canary release
    if: ${{ github.event_name == 'push' && github.repository == 'clerk/javascript' }}
    runs-on: ${{ vars.RUNNER_NORMAL || 'ubuntu-latest' }}
    timeout-minutes: 40
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4.4.0
        with:
          persist-credentials: false
          fetch-depth: 1
          fetch-tags: false
          filter: 'blob:none'

      - name: Setup
        id: config
        uses: $/.github/actions/init
        with:
          cache-enabled: false # OIDC publish job; do not restore poisonable cache state.
          turbo-enabled: false # Remote cache disabled in OIDC publish path.
          turbo-team: ""
          turbo-token: ""

      - name: Upgrade npm for trusted publishing
        run: npx npm@11 install -g npm@11

      - name: Version packages for canary
        id: version-packages
        run: pnpm version-packages:canary | tail -1 >> "$GITHUB_OUTPUT"

      - name: Build release
        if: steps.version-packages.outputs.success == '1'
        run: pnpm turbo build $TURBO_ARGS

      - name: Canary release
        id: publish
        if: steps.version-packages.outputs.success == '1'
        run: pnpm release:canary
        env:
          NPM_CONFIG_PROVENANCE: true

      - name: Trigger workflows on related repos
        if: steps.publish.outcome == 'success'
        continue-on-error: true
        uses: actions/github-script@v7.1.0
        with:
          result-encoding: string
          retries: 3
          retry-exempt-status-codes: 400,401
          github-token: ${{ secrets.CLERK_COOKIE_PAT }}
          script: |
            const clerkjsVersion = require('./packages/clerk-js/package.json').version;
            const clerkUiVersion = require('./packages/ui/package.json').version;
            const nextjsVersion = require('./packages/nextjs/package.json').version;

            const targets = [
              { repo: 'sdk-infra-workers', workflow_id: 'update-pkg-versions.yml', inputs: { clerkjsVersion, clerkUiVersion, sourceCommit: context.sha } },
            ];

            if (nextjsVersion.includes('canary')) {
              console.log('clerk/nextjs changed, will notify clerk/accounts');
              targets.push(
                { repo: 'accounts', workflow_id: 'release-staging.yml', inputs: { version: nextjsVersion } },
              );
            }

            const results = await Promise.allSettled(
              targets.map(t => github.rest.actions.createWorkflowDispatch({ owner: 'clerk', ref: 'main', ...t }))
            );
            const failures = results
              .map((r, i) => r.status === 'rejected' ? { target: targets[i], reason: r.reason } : null)
              .filter(Boolean);
            if (failures.length) {
              failures.forEach(f => core.error(`Dispatch to ${f.target.repo}/${f.target.workflow_id} failed: ${f.reason?.message ?? f.reason}`));
              core.setFailed(`${failures.length} downstream dispatch(es) failed`);
            }

      - name: Notify Slack on failure
        if: ${{ always() && steps.publish.outcome == 'failure' }}
        uses: slackapi/slack-github-action@v1.27.1
        with:
          payload: |
            {
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*:red_circle: Canary release failed*\n*Repo:* `${{ github.repository }}`\n*Workflow:* `${{ github.workflow }}`\n*Commit:* `${{ github.sha }}`\n*Triggered by:* `${{ github.actor }}`\n*Run:* <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SDK_SLACKER_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

  snapshot-request:
    name: Snapshot request
    if: ${{ github.event_name == 'issue_comment' && startsWith(github.event.comment.body, '!snapshot') && github.repository == 'clerk/javascript' && github.event.issue.pull_request }}
    runs-on: ${{ vars.RUNNER_NORMAL || 'ubuntu-latest' }}
    timeout-minutes: 5

    permissions:
      actions: write
      contents: read
      pull-requests: write

    steps:
      - name: Limit action to Clerk members
        uses: actions/github-script@v7.1.0
        with:
          result-encoding: string
          retries: 3
          retry-exempt-status-codes: 400,401
          github-token: ${{ secrets.CLERK_COOKIE_PAT }}
          script: |
            try {
              const { data } = await github.rest.orgs.getMembershipForUser({
                org: 'clerk',
                username: context.actor
              });
              if (data.state !== 'active') {
                core.setFailed(`@${context.actor} is not an active member of the Clerk organization`);
              }
            } catch (e) {
              core.setFailed(`@${context.actor} is not a member of the Clerk organization`);
            }

      - name: Extract snapshot name
        id: extract-snapshot-name
        uses: actions/github-script@v7.1.0
        with:
          script: |
            const match = context.payload.comment.body.match(/!snapshot (.*)/)
            const name = match && match[1] || '';
            const isKebabCase = name.match(/^[a-z]+(-[a-z]+)*$/)
            if(name && !isKebabCase) {
              core.setFailed(`Invalid snapshot name: ${name}`);
            }
            core.setOutput('name', name);

      - name: Validate PR and dispatch snapshot release
        uses: actions/github-script@v7.1.0
        env:
          SNAPSHOT_NAME: ${{ steps.extract-snapshot-name.outputs.name }}
        with:
          result-encoding: string
          retries: 3
          retry-exempt-status-codes: 400,401,422
          script: |
            const { data: pr } = await github.rest.pulls.get({
              owner: 'clerk',
              repo: 'javascript',
              pull_number: context.issue.number,
            });

            if (pr.head.repo.full_name !== pr.base.repo.full_name) {
              core.setFailed('Snapshots are restricted to branches within clerk/javascript.');
              return;
            }

            const commentCreated = new Date(context.payload.comment.created_at);
            const prLastUpdated = new Date(pr.updated_at);

            if (prLastUpdated > commentCreated) {
              core.setFailed("The PR has been updated since !snapshot was initiated. Please review the changes and re-run the !snapshot command.");
              return;
            }

            try {
              await github.rest.actions.createWorkflowDispatch({
                owner: 'clerk',
                repo: 'javascript',
                workflow_id: 'release.yml',
                ref: pr.head.ref,
                inputs: {
                  snapshot_name: process.env.SNAPSHOT_NAME,
                  pr_number: String(context.issue.number),
                  head_sha: pr.head.sha,
                  comment_id: String(context.payload.comment.id),
                  requester: context.payload.comment.user.login,
                },
              });
            } catch (e) {
              if (e.status === 422) {
                core.setFailed('This branch does not support snapshot releases yet. Rebase it on main and re-run the !snapshot command.');
                return;
              }
              throw e;
            }

      - name: Acknowledge request
        uses: peter-evans/create-or-update-comment@v3.1.0
        with:
          comment-id: ${{ github.event.comment.id }}
          reactions: eyes

  snapshot-release:
    name: Snapshot release
    if: ${{ github.event_name == 'workflow_dispatch' && github.repository == 'clerk/javascript' }}
    runs-on: ${{ vars.RUNNER_LARGE || 'ubuntu-latest-l' }}
    timeout-minutes: 40

    permissions:
      contents: read
      id-token: write
      pull-requests: write

    steps:
      - name: Validate dispatch inputs
        uses: actions/github-script@v7.1.0
        env:
          SNAPSHOT_NAME: ${{ inputs.snapshot_name }}
          HEAD_SHA: ${{ inputs.head_sha }}
        with:
          script: |
            const { SNAPSHOT_NAME, HEAD_SHA } = process.env;
            if (SNAPSHOT_NAME && !SNAPSHOT_NAME.match(/^[a-z]+(-[a-z]+)*$/)) {
              core.setFailed(`Invalid snapshot name: ${SNAPSHOT_NAME}`);
            }
            if (HEAD_SHA !== context.sha) {
              core.setFailed(`The branch moved since the snapshot was requested (expected ${HEAD_SHA}, got ${context.sha}). Re-run the !snapshot command.`);
            }

      - name: Checkout repo
        uses: actions/checkout@v4.4.0
        with:
          persist-credentials: false
          fetch-depth: 1
          fetch-tags: false
          filter: 'blob:none'

      - name: Setup
        id: config
        uses: $/.github/actions/init
        with:
          cache-enabled: false # OIDC publish job; do not restore poisonable cache state.
          turbo-enabled: false # Remote cache disabled in OIDC publish path.
          turbo-team: ""
          turbo-token: ""

      - name: Upgrade npm for trusted publishing
        run: npx npm@11 install -g npm@11

      - name: Version packages for snapshot
        id: version-packages
        env:
          SNAPSHOT_NAME: ${{ inputs.snapshot_name }}
        run: pnpm version-packages:snapshot "$SNAPSHOT_NAME" | tail -1 >> "$GITHUB_OUTPUT"

      - name: Build release
        if: steps.version-packages.outputs.success == '1'
        run: pnpm turbo build $TURBO_ARGS

      - name: Snapshot release
        if: steps.version-packages.outputs.success == '1'
        run: pnpm release:snapshot
        env:
          NPM_CONFIG_PROVENANCE: true

      - name: Package info
        if: steps.version-packages.outputs.success == '1'
        id: package-info
        uses: actions/github-script@v7.1.0
        env:
          SNAPSHOT_NAME: ${{ inputs.snapshot_name }}
        with:
          script: |
            const fs = require("fs");
            const files = await (await glob.create("./packages/*/package.json")).glob();
            const descriptors = files
              .map((file) => {
                const { name, version } = JSON.parse(fs.readFileSync(file, "utf8"));
                return { name, version };
              })
              .filter(({ version }) => version.includes(`-${process.env.SNAPSHOT_NAME}`));

            let table = `| Package | Version |\n| --- | --- |\n`;
            descriptors.forEach(({ name, version }) => {
              table += `| ${name} | ${version} |\n`;
            });
            const snippets = descriptors
              .map(
                ({ name, version }) =>
                  `\`${name}\`\n\`\`\`sh\nnpm i ${name}@${version} --save-exact\n\`\`\``
              )
              .join("\n");
            core.setOutput("table", table);
            core.setOutput("snippets", snippets);

      - name: Update Comment
        if: steps.version-packages.outputs.success == '1'
        uses: peter-evans/create-or-update-comment@v3.1.0
        with:
          comment-id: ${{ inputs.comment_id }}
          reactions: heart

      - name: Minimize previous snapshot comments
        if: steps.version-packages.outputs.success == '1'
        uses: actions/github-script@v7.1.0
        env:
          PR_NUMBER: ${{ inputs.pr_number }}
        with:
          script: |
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: Number(process.env.PR_NUMBER),
              per_page: 100,
            });

            const snapshotComments = comments.filter(
              (comment) =>
                comment.body?.includes('the snapshot version command generated the following package versions')
            );

            for (const comment of snapshotComments) {
              await github.graphql(`
                mutation MinimizeComment($id: ID!) {
                  minimizeComment(input: { subjectId: $id, classifier: OUTDATED }) {
                    minimizedComment {
                      isMinimized
                    }
                  }
                }
              `, { id: comment.node_id });
            }

      - name: Create snapshot release comment
        if: steps.version-packages.outputs.success == '1'
        uses: peter-evans/create-or-update-comment@v3.1.0
        with:
          issue-number: ${{ inputs.pr_number }}
          body: |
            Hey @${{ inputs.requester }} - the snapshot version command generated the following package versions:
            ${{ steps.package-info.outputs.table }}
            Tip: Use the snippet copy button below to quickly install the required packages.
            ${{ steps.package-info.outputs.snippets }}

  # We're running the CI workflow (where node v20 modules are cached) in
  # merge_group and not on main, we need to explicitly cache node_modules here so
  # that follow-on branches can use the cached version of node_modules rather
  # than recreating them every time.
  cache-for-alternate-node-versions:
    name: Cache for Alternate Node Versions
    if: ${{ github.event_name == 'push' }}
    runs-on: ${{ vars.RUNNER_NORMAL || 'ubuntu-latest' }}
    timeout-minutes: ${{ vars.TIMEOUT_MINUTES_NORMAL && fromJSON(vars.TIMEOUT_MINUTES_NORMAL) || 10 }}
    continue-on-error: true

    permissions:
      contents: read

    strategy:
      matrix:
        version: [24] # NOTE: 20 is cached in the main release workflow

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4.4.0
        with:
          persist-credentials: false
          fetch-depth: 1
          fetch-tags: false
          filter: "blob:none"
          show-progress: false

      - name: Cache node_modules (Node v${{ matrix.version }})
        uses: $/.github/actions/init
        with:
          cache-enabled: true
          node-version: ${{ matrix.version }}
          turbo-enabled: false
          turbo-team: ""
          turbo-token: ""