chore(deps): integrate security and Effect v4 RC upgrades (#153) #36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🚀 Release Alpha | |
| on: | |
| push: | |
| branches: [dev] | |
| workflow_dispatch: | |
| inputs: | |
| publish_only: | |
| description: "Publish existing alpha versions without versioning, changelog, or git changes" | |
| required: true | |
| type: boolean | |
| default: false | |
| projects: | |
| description: "Comma-separated existing Nx release project names; required for publish-only recovery" | |
| required: false | |
| type: string | |
| concurrency: | |
| group: release-alpha | |
| cancel-in-progress: false | |
| env: | |
| DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/effectify" | |
| jobs: | |
| release-alpha: | |
| name: 🚀 Release Alpha | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # Needed for git operations | |
| id-token: write # Needed for npm provenance | |
| services: | |
| postgres: | |
| image: postgres:16-alpine | |
| env: | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: effectify | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| steps: | |
| - name: 📥 Checkout | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: 📦 Install pnpm | |
| uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10.14.0 | |
| - name: 🏗️ Setup Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: "22.22.0" | |
| cache: "pnpm" | |
| registry-url: "https://registry.npmjs.org/" | |
| - name: 📦 Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: 🔧 Configure Git | |
| if: ${{ inputs.publish_only != true }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| - name: 🔍 Detect Affected Release Projects | |
| id: affected | |
| env: | |
| PUBLISH_ONLY: ${{ inputs.publish_only || false }} | |
| RECOVERY_PROJECTS: ${{ inputs.projects || '' }} | |
| run: | | |
| RELEASE_PATHS=$(jq -r '.release.projects[]' nx.json | sort | uniq) | |
| RELEASE_PROJECTS="" | |
| for path in $RELEASE_PATHS; do | |
| PROJECT_NAME=$(pnpm nx show project "$path" --json 2>/dev/null | jq -r '.name' 2>/dev/null) | |
| if [ -n "$PROJECT_NAME" ] && [ "$PROJECT_NAME" != "null" ]; then | |
| RELEASE_PROJECTS="$RELEASE_PROJECTS $PROJECT_NAME" | |
| fi | |
| done | |
| RELEASE_PROJECTS=$(echo "$RELEASE_PROJECTS" | tr ' ' '\n' | sort | uniq) | |
| if [ "$PUBLISH_ONLY" = "true" ]; then | |
| if [ -z "$RECOVERY_PROJECTS" ]; then | |
| echo "publish-only recovery requires an explicit comma-separated projects input" >&2 | |
| exit 1 | |
| fi | |
| SELECTED_PROJECTS=$(printf '%s' "$RECOVERY_PROJECTS" | tr ',' '\n' | sed '/^$/d' | sort -u) | |
| while IFS= read -r project; do | |
| if ! printf '%s\n' "$RELEASE_PROJECTS" | grep -Fx -- "$project" >/dev/null; then | |
| echo "Invalid release project: $project" >&2 | |
| exit 1 | |
| fi | |
| done <<< "$SELECTED_PROJECTS" | |
| AFFECTED_RELEASE_PROJECTS=$(printf '%s' "$SELECTED_PROJECTS" | paste -sd, -) | |
| echo "has_projects=true" >> "$GITHUB_OUTPUT" | |
| echo "projects=$AFFECTED_RELEASE_PROJECTS" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| AFFECTED_RAW=$(pnpm nx show projects --affected --base=origin/dev~1 --head=HEAD --json 2>/dev/null || echo "[]") | |
| AFFECTED_RELEASE_PROJECTS=$(echo "$AFFECTED_RAW" | jq -r --arg release "$RELEASE_PROJECTS" '[.[] | select(. as $p | $release | contains($p))] | join(",")' 2>/dev/null || echo "") | |
| if [ -z "$AFFECTED_RELEASE_PROJECTS" ] || [ "$AFFECTED_RELEASE_PROJECTS" = "null" ]; then | |
| echo "has_projects=false" >> "$GITHUB_OUTPUT" | |
| echo "projects=" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "has_projects=true" >> "$GITHUB_OUTPUT" | |
| echo "projects=$AFFECTED_RELEASE_PROJECTS" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: 🏗️ Build Affected Projects | |
| if: ${{ steps.affected.outputs.has_projects == 'true' }} | |
| env: | |
| PROJECTS: ${{ steps.affected.outputs.projects }} | |
| run: pnpm nx run-many -t build "--projects=$PROJECTS" --parallel=3 | |
| - name: 🧪 Test Affected Projects | |
| if: ${{ steps.affected.outputs.has_projects == 'true' }} | |
| env: | |
| PROJECTS: ${{ steps.affected.outputs.projects }} | |
| run: pnpm nx run-many -t test "--projects=$PROJECTS" --parallel=3 --passWithNoTests | |
| - name: 🔐 Verify npm authentication | |
| if: ${{ steps.affected.outputs.has_projects == 'true' }} | |
| run: npm whoami | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: 🚀 Version, Changelog & Publish Alpha | |
| if: ${{ steps.affected.outputs.has_projects == 'true' }} | |
| env: | |
| PROJECTS: ${{ steps.affected.outputs.projects }} | |
| PUBLISH_ONLY: ${{ inputs.publish_only || false }} | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_CONFIG_PROVENANCE: true | |
| run: | | |
| if [ "$PUBLISH_ONLY" != "true" ]; then | |
| pnpm nx release "--projects=$PROJECTS" --preid=alpha --skip-publish | |
| pnpm nx run-many -t build "--projects=$PROJECTS" --parallel=3 | |
| fi | |
| # Publish-only mode builds selected existing manifests and performs no git mutation. | |
| pnpm nx release publish "--projects=$PROJECTS" --tag=alpha | |
| - name: 📊 Release Summary | |
| if: always() | |
| env: | |
| HAS_PROJECTS: ${{ steps.affected.outputs.has_projects }} | |
| PROJECTS: ${{ steps.affected.outputs.projects }} | |
| PUBLISH_ONLY: ${{ inputs.publish_only || false }} | |
| run: | | |
| echo "## 🚀 Alpha Release Summary" >> "$GITHUB_STEP_SUMMARY" | |
| if [ "$HAS_PROJECTS" = "true" ]; then | |
| echo "**Projects:** $PROJECTS" >> "$GITHUB_STEP_SUMMARY" | |
| if [ "$PUBLISH_ONLY" = "true" ]; then | |
| echo "**Mode:** publish-only recovery; selected existing manifests were built and published with the alpha tag." >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| else | |
| echo "⏭️ **Skipped - No affected projects**" >> "$GITHUB_STEP_SUMMARY" | |
| fi |