From b21634f17cc66cd4dd85fa1473336ceecae695c6 Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Thu, 8 Oct 2026 12:35:10 +0200 Subject: [PATCH 1/3] ci: publish releases with semantic-release Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build.yml | 39 +++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a809f1b..8eebd76 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -13,6 +13,9 @@ concurrency: permissions: contents: read +env: + DRY_RUN: ${{ github.ref_name != github.event.repository.default_branch && !startsWith(github.ref_name, 'maint/') }} + jobs: setup: runs-on: ubuntu-latest @@ -52,3 +55,39 @@ jobs: run: | pnpm test pnpm build + + release: + needs: + - lint + - test + runs-on: ubuntu-latest + timeout-minutes: 15 + + permissions: + contents: write + issues: write + id-token: write + + steps: + # full checkout for semantic-release + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + show-progress: false + filter: blob:none # we don't need all blobs + + - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + + - name: ⚙️ Setup + uses: containerbase/internal-tools/setup@d7fbd383dbf6cddf7e6bb2d787342a7f1cb92620 # v5.0.54 + with: + checkout: false + + # Ensure npm 11.5.1 or later for trusted publishing + - run: npm install -g npm@latest + + - name: semantic-release + if: github.event_name == 'push' + run: pnpm semantic-release --dry-run ${{env.DRY_RUN}} --ci ${{env.DRY_RUN != 'true'}} + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From bf1af6ab381aec7d932a57bb9163640eb21a25bd Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Thu, 8 Oct 2026 12:48:48 +0200 Subject: [PATCH 2/3] ci: drop the global npm update Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8eebd76..6399934 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -83,9 +83,6 @@ jobs: with: checkout: false - # Ensure npm 11.5.1 or later for trusted publishing - - run: npm install -g npm@latest - - name: semantic-release if: github.event_name == 'push' run: pnpm semantic-release --dry-run ${{env.DRY_RUN}} --ci ${{env.DRY_RUN != 'true'}} From 33812ff909dffa1dae868e12ac2b8a266b497574 Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Thu, 8 Oct 2026 12:53:00 +0200 Subject: [PATCH 3/3] ci: publish with the containerbase pnpm semantic-release plugin Co-Authored-By: Claude Opus 5.5 --- .releaserc.json | 8 +------ package.json | 2 +- pnpm-lock.yaml | 59 ++++++++++++++----------------------------------- 3 files changed, 19 insertions(+), 50 deletions(-) diff --git a/.releaserc.json b/.releaserc.json index b188052..8738987 100644 --- a/.releaserc.json +++ b/.releaserc.json @@ -9,13 +9,7 @@ "successCommentCondition": false } ], - [ - "@semantic-release/exec", - { - "prepareCmd": "pnpm version ${nextRelease.version} --git-tag-version=false", - "publishCmd": "pnpm publish --no-git-checks" - } - ] + "@containerbase/semantic-release-pnpm" ], "analyzeCommits": { "releaseRules": [ diff --git a/package.json b/package.json index 39adb5c..b1426de 100644 --- a/package.json +++ b/package.json @@ -40,7 +40,7 @@ "@oxlint/plugins": "1.86.0" }, "devDependencies": { - "@semantic-release/exec": "7.1.0", + "@containerbase/semantic-release-pnpm": "1.4.3", "@tsconfig/node24": "24.0.5", "@tsconfig/strictest": "2.0.8", "@types/common-tags": "1.8.4", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 23682ce..eea5f7d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -170,9 +170,9 @@ importers: specifier: 1.86.0 version: 1.86.0 devDependencies: - '@semantic-release/exec': - specifier: 7.1.0 - version: 7.1.0(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0) + '@containerbase/semantic-release-pnpm': + specifier: 1.4.3 + version: 1.4.3(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3)) '@tsconfig/node24': specifier: 24.0.5 version: 24.0.5 @@ -248,6 +248,12 @@ packages: resolution: {integrity: sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==} engines: {node: '>=0.1.90'} + '@containerbase/semantic-release-pnpm@1.4.3': + resolution: {integrity: sha512-dOMyBw+mzcKHt6OqYyRj6arFeszoINlNRq1eIR7oEE0TB0i0lhj8BsJ/2IFISJUPwf9lUxKbV8ES6vjqqMIQYg==} + engines: {node: ^22.11.0 || ^24} + peerDependencies: + semantic-release: ^24.0.0 || ^25.0.0 + '@jridgewell/sourcemap-codec@1.6.0': resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==} @@ -588,12 +594,6 @@ packages: resolution: {integrity: sha512-mgdxrHTLOjOddRVYIYDo0fR3/v61GNN1YGkfbrjuIKg/uMgCd+Qzo3UAXJ+woLQQpos4pl5Esuw5A7AoNlzjUQ==} engines: {node: '>=18'} - '@semantic-release/exec@7.1.0': - resolution: {integrity: sha512-4ycZ2atgEUutspPZ2hxO6z8JoQt4+y/kkHvfZ1cZxgl9WKJId1xPj+UadwInj+gMn2Gsv+fLnbrZ4s+6tK2TFQ==} - engines: {node: '>=20.8.1'} - peerDependencies: - semantic-release: '>=24.1.0' - '@semantic-release/github@12.0.10': resolution: {integrity: sha512-QskygvpX8hFx9UEbqJ+C46OIhaJjsysNQ8PYJPuRDc/ek5+dh8WYGD1ofUahCcGLAOmnnwZTcmCJCEXM8XxhRw==} engines: {node: ^22.14.0 || >= 24.10.0} @@ -684,10 +684,6 @@ packages: resolution: {integrity: sha512-TQf59BsZnytt8GdJKLPfUZ54g/iaUL2OWDSFCCvMOhsHduDQxO8xC4PNeyIkVcA5KwL2phPSv0douC0fgWzmnA==} engines: {node: '>= 20'} - aggregate-error@3.1.0: - resolution: {integrity: sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==} - engines: {node: '>=8'} - aggregate-error@5.0.0: resolution: {integrity: sha512-gOsf2YwSlleG6IjRYG2A7k0HmBMEo6qVNk9Bp/EaLgAJT5ngH6PXbqa4ItvnEwCm/velL5jAnQgsHsWnjhGmvw==} engines: {node: '>=18'} @@ -770,10 +766,6 @@ packages: resolution: {integrity: sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==} engines: {node: '>=10'} - clean-stack@2.2.0: - resolution: {integrity: sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==} - engines: {node: '>=6'} - clean-stack@5.3.0: resolution: {integrity: sha512-9ngPTOhYGQqNVSfeJkYXHmF7AGWp4/nN5D/QqNQs3Dvxd1Kk/WpjHfNujKHYUQ/5CoGyOyFNoWSPk5afzP0QVg==} engines: {node: '>=14.16'} @@ -1098,10 +1090,6 @@ packages: import-meta-resolve@4.2.0: resolution: {integrity: sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg==} - indent-string@4.0.0: - resolution: {integrity: sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==} - engines: {node: '>=8'} - indent-string@5.0.0: resolution: {integrity: sha512-m6FAo/spmsW2Ab2fU35JTYwtOKa2yAwXSwgjSv1TJzh4Mh7mC3lzAOVLBprb72XsTrgkEIsl7YrFNAiDiRhIGg==} engines: {node: '>=12'} @@ -2138,6 +2126,14 @@ snapshots: '@colors/colors@1.5.0': optional: true + '@containerbase/semantic-release-pnpm@1.4.3(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))': + dependencies: + '@semantic-release/error': 4.0.0 + aggregate-error: 5.0.0 + execa: 9.6.1 + semantic-release: 25.0.9(supports-color@7.2.0)(typescript@6.0.3) + semver: 7.8.5 + '@jridgewell/sourcemap-codec@1.6.0': {} '@octokit/auth-token@6.0.0': {} @@ -2362,18 +2358,6 @@ snapshots: '@semantic-release/error@4.0.0': {} - '@semantic-release/exec@7.1.0(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)': - dependencies: - '@semantic-release/error': 4.0.0 - aggregate-error: 3.1.0 - debug: 4.4.3(supports-color@7.2.0) - execa: 9.6.1 - lodash-es: 4.18.1 - parse-json: 8.3.0 - semantic-release: 25.0.9(supports-color@7.2.0)(typescript@6.0.3) - transitivePeerDependencies: - - supports-color - '@semantic-release/github@12.0.10(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)': dependencies: '@octokit/core': 7.0.8 @@ -2503,11 +2487,6 @@ snapshots: agent-base@9.0.0: {} - aggregate-error@3.1.0: - dependencies: - clean-stack: 2.2.0 - indent-string: 4.0.0 - aggregate-error@5.0.0: dependencies: clean-stack: 5.3.0 @@ -2570,8 +2549,6 @@ snapshots: char-regex@1.0.2: {} - clean-stack@2.2.0: {} - clean-stack@5.3.0: dependencies: escape-string-regexp: 5.0.0 @@ -2892,8 +2869,6 @@ snapshots: import-meta-resolve@4.2.0: {} - indent-string@4.0.0: {} - indent-string@5.0.0: {} index-to-position@1.2.0: {}