Share GitHub workflows - #11
Merged
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (19)
🚧 Files skipped from review as they are similar to previous changes (12)
📝 WalkthroughWalkthroughThe change adds reusable CI, CodeQL, release, and Scorecard workflows. It introduces a typed ChangesGHA workflows and release tooling
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant CallerWorkflow
participant SharedReleaseWorkflow
participant NpmRegistry
participant GhaCLI
participant GitHubAPI
CallerWorkflow->>SharedReleaseWorkflow: invoke shared-release.yml
SharedReleaseWorkflow->>NpmRegistry: publish public packages
SharedReleaseWorkflow->>GhaCLI: run shared-workflows-release or github-releases
GhaCLI->>GitHubAPI: create tags and releases
GitHubAPI-->>CallerWorkflow: return workflow result
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (2)
.github/workflows/ci.yml (1)
56-59: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valuePrint untracked output as well as modified output.
git status --porcelainreports untracked files, butgit diffdoes not show them. If the rebuild adds a new file under.github/scripts, the job fails with no visible detail. Print the porcelain status next to the diff.♻️ Proposed change
if [ -n "$(git status --porcelain -- .github/scripts)" ]; then echo "::error::.github/scripts is stale, rebuild `@zemd/gha` and commit the result" + git status --porcelain -- .github/scripts git --no-pager diff -- .github/scripts exit 1 fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 56 - 59, Update the stale `.github/scripts` check in the CI workflow to print the `git status --porcelain -- .github/scripts` output alongside the existing `git diff`, ensuring untracked files are visible when the rebuild check fails.internal/gha/src/release-pr-body.ts (1)
87-93: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueExtract the duplicated release table.
Lines 87-93 and 112-118 render the same table with the same header, separator, and row format. Extract one helper so a future column change updates both sections.
♻️ Proposed helper
+const releaseTable = (out: string[], releases: readonly PreparedRelease[]): void => { + out.push("| Package | Bump | Current | Next |"); + out.push("| :--- | :---: | ---: | ---: |"); + for (const release of releases) { + const current = release.from ? `\`${release.from}\`` : "—"; + out.push(`| \`${release.name}\` | ${badge[release.kind]} | ${current} | \`${release.to}\` |`); + } +};Then replace both blocks with
releaseTable(out, releases)andreleaseTable(out, internal).Also applies to: 112-118
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/gha/src/release-pr-body.ts` around lines 87 - 93, Extract the shared release-table rendering logic from the duplicated blocks into a helper such as releaseTable, including the header, separator, and release-row formatting. Replace both table-rendering sections with calls using releases and internal respectively, preserving their existing output order and formatting.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 62-70: Update the “Require a release intent when the shared
contract changes” step to check whether BASE_SHA or HEAD_SHA is empty before
invoking git diff; skip the shared contract check when either input is
unavailable, while preserving the existing diff and validation behavior when
both SHAs are present.
In @.github/workflows/shared-release.yml:
- Around line 118-119: Update the shared-tooling checkout configuration around
the repository and ref fields to use supported GitHub Actions context values.
Add explicit reusable-workflow inputs for the repository and ref and reference
those inputs, or derive both values from supported workflow context while
preserving the intended shared-tooling checkout target.
In @.prettierignore:
- Line 1: Update the comment in .prettierignore to reference the actual
generator source file, internal/gha/scripts/sync.ts, instead of the incorrect
.mjs path.
In `@internal/gha/src/changelog.ts`:
- Around line 4-17: Update the heading match in changelogEntry to accept an
optional date suffix after the requested version, while continuing to support
Changesets headings such as ## 1.0.0 and bracketed versions. Ensure canonical
headings like ## [1.0.0] - 2026-01-01 resolve to the corresponding entry instead
of returning an empty result.
In `@internal/gha/src/github.ts`:
- Line 94: Update the GitHub client option handling in
internal/gha/src/github.ts at lines 94-94 to add a graphqlUrl option, defaulting
to GitHub.com’s GraphQL endpoint, and build the graphql request from it instead
of apiUrl. In internal/gha/src/commands/context.ts at lines 4-9, pass
GITHUB_GRAPHQL_URL when constructing the client.
In `@internal/gha/src/shared-workflows.test.ts`:
- Around line 58-71: The existing exact-tag check in releaseSharedWorkflows
incorrectly treats vX.Y.Z as proof of completion; gate the no-op path on the
corresponding GitHub release, or resume any missing major-tag and release steps
when the exact tag exists. Update the test to use an existing release for the
no-op case, and add failure-and-retry coverage for both moving the major tag and
creating the GitHub release.
In `@internal/gha/src/shared-workflows.ts`:
- Around line 109-142: Update the early-return logic in the release workflow to
check whether the GitHub release for tag is present, rather than relying on
api.tagExists(tag), so an existing tag with a missing release can be repaired.
Reuse the fetched releases collection for previousTag lookup, and make the retry
path tolerate the already-existing version tag by passing force to putTag or
treating that condition as success.
In `@internal/gha/src/signed-commit.ts`:
- Around line 28-34: Update the rename/copy handling around the status check to
inspect both Git status columns, so entries marked in either index or work-tree
column consume the paired origin pathname and update added/deleted sets
correctly. Preserve existing handling for ordinary records, and add regression
coverage for work-tree renames and copies to ensure no empty pathname reaches
file reading.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 56-59: Update the stale `.github/scripts` check in the CI workflow
to print the `git status --porcelain -- .github/scripts` output alongside the
existing `git diff`, ensuring untracked files are visible when the rebuild check
fails.
In `@internal/gha/src/release-pr-body.ts`:
- Around line 87-93: Extract the shared release-table rendering logic from the
duplicated blocks into a helper such as releaseTable, including the header,
separator, and release-row formatting. Replace both table-rendering sections
with calls using releases and internal respectively, preserving their existing
output order and formatting.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 8de39507-33ad-45a8-b9f2-b7ba33c6aff7
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (59)
.changeset/shared-github-workflows.md.gitattributes.github/CODEOWNERS.github/dependabot.yml.github/scripts/gha.mjs.github/scripts/github-releases.mjs.github/scripts/release-pr-body.mjs.github/scripts/release-pr-body.test.mjs.github/scripts/release-workflow.test.mjs.github/scripts/signed-commit.mjs.github/workflows-examples/README.md.github/workflows-examples/ci.yml.github/workflows-examples/codeql.yml.github/workflows-examples/dependabot.yml.github/workflows-examples/release.yml.github/workflows-examples/scorecard.yml.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/release.yml.github/workflows/scorecard.yml.github/workflows/shared-ci.yml.github/workflows/shared-codeql.yml.github/workflows/shared-release.yml.github/workflows/shared-scorecard.yml.prettierignoreinternal/gha/README.mdinternal/gha/package.jsoninternal/gha/scripts/sync.tsinternal/gha/src/changelog.tsinternal/gha/src/cli.tsinternal/gha/src/commands/command.tsinternal/gha/src/commands/context.tsinternal/gha/src/commands/github-releases.tsinternal/gha/src/commands/index.test.tsinternal/gha/src/commands/index.tsinternal/gha/src/commands/release-pr-body.tsinternal/gha/src/commands/shared-workflows-release.tsinternal/gha/src/commands/signed-commit.tsinternal/gha/src/env.tsinternal/gha/src/github-releases.test.tsinternal/gha/src/github-releases.tsinternal/gha/src/github.test.tsinternal/gha/src/github.tsinternal/gha/src/pnpm.test.tsinternal/gha/src/pnpm.tsinternal/gha/src/release-pr-body.test.tsinternal/gha/src/release-pr-body.tsinternal/gha/src/semver.tsinternal/gha/src/shared-workflows.test.tsinternal/gha/src/shared-workflows.tsinternal/gha/src/signed-commit.test.tsinternal/gha/src/signed-commit.tsinternal/gha/src/testing/fake-github.tsinternal/gha/src/workflows.test.tsinternal/gha/tsconfig.jsoninternal/gha/tsdown.config.jspackage.jsonpnpm-workspace.yamlturbo.json
💤 Files with no reviewable changes (5)
- .github/scripts/release-pr-body.mjs
- .github/scripts/signed-commit.mjs
- .github/scripts/github-releases.mjs
- .github/scripts/release-pr-body.test.mjs
- .github/scripts/release-workflow.test.mjs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces a major update to the repository's GitHub Actions automation. It publishes the internal CI, CodeQL, Scorecard, and release pipelines as reusable, shared workflows, and moves the release tooling into a typed, tested package whose bundle is committed to
.github/scripts. As part of this, the old release scripts (github-releases.mjs,release-pr-body.mjs, andsigned-commit.mjs) and their tests are removed, and repository metadata is updated to reflect these changes in ownership, attributes, and dependency update paths.Shared workflow and release tooling migration:
shared-*.ymlworkflows, allowing other monorepos to consume them by pinned SHA, and moves release tooling into a typed, tested package with its bundle committed to.github/scripts(.changeset/shared-github-workflows.md).Repository metadata and ownership updates:
.github/CODEOWNERSto assign ownership of the new shared workflow files, scripts, and internal GHA tooling to@zemd(/.github/workflows/shared-*.yml,/.github/scripts/,/internal/gha/)..github/scripts/*.mjsfiles as generated in.gitattributesto reduce noise in diffs.Dependency and update configuration:
/internal/*to the list of directories Dependabot monitors for dependency updates in.github/dependabot.yml.Deletions of legacy scripts and tests:
github-releases.mjs,release-pr-body.mjs,signed-commit.mjs, and their associated tests (release-pr-body.test.mjs,release-workflow.test.mjs), as these are now replaced by the new shared workflows and package [1] [2] [3] [4] [5].