changesets.yml

name: Handle Changesets

# Runs on every push to main.
#
# If `.changeset/*.md` files are present, opens (or updates) a
# "Version Packages" PR that consumes them: bumping `packages/cli`'s
# version, regenerating `CHANGELOG.md`, and deleting the consumed
# changesets.
#
# When the "Version Packages" PR is merged, this workflow runs again
# and — finding no changesets — publishes the new version to npm. In
# Changesets prerelease mode, the configured tag remains the semver
# prerelease identifier while publishing explicitly targets npm's latest tag.
# The Changesets action derives the GitHub release channel from the version,
# so a post-publish step also promotes the release to Latest.
#
# Publishing uses npm trusted publishing (OIDC) instead of a long-
# lived `NPM_TOKEN`. The npm CLI detects the `id-token: write`
# permission below and exchanges a short-lived OIDC token for a
# publish credential. Provenance attestations are generated
# automatically when publishing via OIDC from a public repo.
#
# Modeled after workers-sdk's `.github/workflows/changesets.yml`.
#
# One-time setup (must be done on npmjs.com before this workflow
# can publish):
#   1. Visit https://www.npmjs.com/package/cf — Settings →
#      Trusted Publisher.
#   2. Add a GitHub Actions trusted publisher:
#        Organization or user: cloudflare
#        Repository:           cf
#        Workflow filename:    changesets.yml
#        Allowed actions:      npm publish
#   3. (Recommended) Settings → Publishing access →
#      "Require two-factor authentication and disallow tokens"
#      to lock out long-lived tokens entirely.

on:
  push:
    branches:
      - main

permissions:
  # `id-token: write` allows the runner to mint an OIDC token, which
  # npm exchanges for a short-lived publish credential. Required for
  # trusted publishing.
  id-token: write
  contents: read
  # Note: no `pull-requests: write` here. The workflow uses
  # `GH_ACCESS_TOKEN` (a fine-grained PAT) for PR creation so that
  # the resulting "Version Packages" PR triggers our other workflows,
  # which a `GITHUB_TOKEN`-authored PR would not.

jobs:
  release:
    if: ${{ github.repository_owner == 'cloudflare' }}
    name: Handle Changesets
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout Repo # zizmor: ignore[artipacked] Changesets needs git push credentials
        # Changesets' default git-cli commit mode needs the persisted credential
        # to push the version-packages branch.
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          # See https://github.com/changesets/action/issues/187
          token: ${{ secrets.GH_ACCESS_TOKEN }}
          # Pull in enough history to cover the changeset commits
          fetch-depth: 500

      - name: Install Dependencies
        # Node 24 ships with npm 11+, which is required for trusted
        # publishing (npm ≥ 11.5.1). `registry-url` writes the runner's
        # `.npmrc` so the npm CLI knows where to exchange its OIDC
        # token. `disable-cache: "true"` skips the pnpm store cache —
        # release builds resolve every dep from the registry rather
        # than restoring from a (potentially poisoned) cache.
        uses: $/.github/actions/install-dependencies
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
          disable-cache: "true"

      - name: Build cf
        # `pnpm build` defaults to a minified bundle without source maps.
        # See `packages/cli/vite.config.ts`.
        run: pnpm build
        env:
          SPARROW_SOURCE_KEY: ${{ secrets.SPARROW_SOURCE_KEY }}

      - name: Create Version PR or Publish to npm
        id: changesets
        # Pinned by SHA — supply-chain hardening.
        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
        with:
          # `version` runs when there are pending changesets. It
          # opens (or updates) the "Version Packages" PR with the
          # bumped versions + regenerated CHANGELOG.md. Changesets
          # emits "loose" markdown lists (a blank line before nested
          # bullet lists) that Vite+ formatting tightens, so the raw changelog
          # fails `pnpm check`'s format check. The `changeset:version`
          # script chains `vp fmt` after generation so the changelog is
          # formatted before the changesets action commits it. (The
          # action execs this input directly — it is NOT shell-
          # interpreted — so the `&&` must live in the script, not here.)
          version: pnpm run changeset:version
          # `publish` runs after the "Version Packages" PR has
          # merged and no changesets remain. It tags + publishes
          # to npm via OIDC.
          # (For now we want to force the latest tag rather than, say, beta.)
          publish: pnpm exec changeset publish --tag latest
        env:
          # `GH_ACCESS_TOKEN` (fine-grained PAT) for the PR commits.
          # npm publishing uses OIDC — no `NPM_TOKEN` required.
          GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}

      - name: Promote GitHub release to latest
        if: steps.changesets.outputs.published == 'true'
        # changesets/action marks every hyphenated version as a prerelease,
        # independently of the npm dist-tag used by the publish command. Keep
        # the GitHub release channel aligned with `--tag latest` above.
        run: |
          release_tag="$(
            jq -er '.[] | select(.name == "cf") | "\(.name)@\(.version)"' \
              <<< "$PUBLISHED_PACKAGES"
          )"
          gh release edit "$release_tag" --prerelease=false --latest
        env:
          GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
          PUBLISHED_PACKAGES: ${{ steps.changesets.outputs.publishedPackages }}