From d276090b826ff9a869f4f617fc3b7b67db2c7ef0 Mon Sep 17 00:00:00 2001 From: Artem Savchenko Date: Sun, 22 Feb 2026 20:13:57 +0700 Subject: [PATCH 1/2] Bump and publish npm packages for v tags Signed-off-by: Artem Savchenko --- .../actions/set-package-versions/action.yml | 22 +++++++ .github/workflows/main.yml | 65 +++++++++++++++++-- common/scripts/bump.js | 15 ++++- 3 files changed, 96 insertions(+), 6 deletions(-) create mode 100644 .github/actions/set-package-versions/action.yml diff --git a/.github/actions/set-package-versions/action.yml b/.github/actions/set-package-versions/action.yml new file mode 100644 index 00000000000..c96242ac427 --- /dev/null +++ b/.github/actions/set-package-versions/action.yml @@ -0,0 +1,22 @@ +# Reusable action: set all @hcengineering package versions from a v tag ref +# (e.g. refs/tags/v0.7.370 → 0.7.370) using common/scripts/bump.js. +# Call only when github.ref is a v* tag (e.g. if: startsWith(github.ref, 'refs/tags/v')). +name: 'Set package versions' +description: 'Set all @hcengineering package versions from a v tag ref using bump.js' +inputs: + ref: + description: 'Git ref for the tag (e.g. github.ref, e.g. refs/tags/v0.7.370)' + required: true +outputs: + version: + description: 'Semver version derived from the tag (e.g. 0.7.370)' +runs: + using: 'composite' + steps: + - id: bump + run: | + VERSION="${INPUT_REF#refs/tags/v}" + echo "version=$VERSION" >> $GITHUB_OUTPUT + echo "VERSION=$VERSION" >> $GITHUB_ENV + node common/scripts/bump.js "$VERSION" + shell: bash diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 2d674e41849..bbe62a46256 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -19,6 +19,16 @@ on: # Allows you to run this workflow manually from the Actions tab workflow_dispatch: + inputs: + ref: + description: 'Ref to run as (e.g. refs/tags/v0.7.370 to test release flow)' + required: false + default: 'refs/heads/develop' + skip_publish: + description: 'Skip all publishing (npm, Docker, R2) when testing release flow' + required: false + default: false + type: boolean env: CacheFolders: | @@ -57,12 +67,18 @@ jobs: steps: - uses: actions/checkout@v6 with: + ref: ${{ github.event.inputs.ref || github.ref }} fetch-depth: 0 filter: tree:0 submodules: recursive - uses: actions/setup-node@v6 with: node-version-file: '.nvmrc' + - name: Set package versions + if: startsWith(github.event.inputs.ref || github.ref, 'refs/tags/v') + uses: ./.github/actions/set-package-versions + with: + ref: ${{ github.event.inputs.ref || github.ref }} - name: Cache node modules uses: actions/cache@v5 env: @@ -74,6 +90,15 @@ jobs: restore-keys: | ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/pnpm-lock.yaml') }} + - name: Installing... + run: | + REF="${{ github.event.inputs.ref || github.ref }}" + if [[ "$REF" == refs/tags/v* ]]; then + node common/scripts/install-run-rush.js update + else + node common/scripts/install-run-rush.js install + fi + # - name: Cheking model is updated... # run: node common/scripts/check_model_version.js @@ -83,9 +108,6 @@ jobs: - name: Checking for mis-matching transitive dependencies... run: node common/scripts/check-versions.js - - name: Installing... - run: node common/scripts/install-run-rush.js install - - name: Model version from git tags run: node common/scripts/install-run-rush.js model-version @@ -698,12 +720,12 @@ jobs: # if: ${{ github.ref == 'refs/heads/main' }} # run: node common/scripts/install-run-rush.js docker:staging -v - name: Docker push tag - if: ${{ startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/s') }} + if: ${{ (startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/s')) && (github.event_name != 'workflow_dispatch' || github.event.inputs.skip_publish != 'true') }} run: | echo Pushing release of tag ${{ github.ref }} node common/scripts/install-run-rush.js docker:push -v - name: Docker push love-agent - if: ${{ startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/s') }} + if: ${{ (startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/s')) && (github.event_name != 'workflow_dispatch' || github.event.inputs.skip_publish != 'true') }} run: | echo Pushing love-agent release of tag ${{ github.ref }} cd ./services/ai-bot/love-agent @@ -782,6 +804,7 @@ jobs: node ../common/scripts/install-run-rushx.js dist-signed --macos --x64 --arm64 ./scripts/copy-publish-artifacts.sh ${{ env.PublishTempFolder}} - name: Publish distribution assets and version + if: github.event_name != 'workflow_dispatch' || github.event.inputs.skip_publish != 'true' uses: ryand56/r2-upload-action@latest with: r2-account-id: ${{ secrets.R2_ACCOUNT_ID }} @@ -884,6 +907,7 @@ jobs: node ../common/scripts/install-run-rushx.js dist-signed --macos --x64 --arm64 ./scripts/copy-publish-artifacts.sh ${{ env.PublishTempFolder}} - name: Publish distribution assets and version + if: github.event_name != 'workflow_dispatch' || github.event.inputs.skip_publish != 'true' uses: ryand56/r2-upload-action@latest with: r2-account-id: ${{ secrets.R2_ACCOUNT_ID }} @@ -912,3 +936,34 @@ jobs: with: name: TraceX-Linux path: ./qms-desktop-package/deploy/TraceX-linux-*.zip + + publish-npm: + if: startsWith(github.event.inputs.ref || github.ref, 'refs/tags/v') && (github.event_name != 'workflow_dispatch' || github.event.inputs.skip_publish != 'true') + needs: build + runs-on: ubuntu-latest + timeout-minutes: 30 + steps: + - uses: actions/checkout@v6 + with: + ref: ${{ github.event.inputs.ref || github.ref }} + fetch-depth: 0 + - uses: actions/setup-node@v6 + with: + node-version-file: '.nvmrc' + - name: Cache node modules + uses: actions/cache@v5 + env: + cache-name: cache-node-platform + with: + path: common/temp + key: ${{ runner.os }}-build-cache-node-platform-${{ hashFiles('**/pnpm-lock.yaml') }} + restore-keys: ${{ runner.os }}-build-cache-node-platform- + - name: Installing... + run: node common/scripts/install-run-rush.js install + - name: Publish to npm + env: + NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + run: | + REF="${{ github.event.inputs.ref || github.ref }}" + VERSION="${REF#refs/tags/v}" + node common/scripts/bump.js "$VERSION" --publish diff --git a/common/scripts/bump.js b/common/scripts/bump.js index 3ef140a9d0e..48f68bf685f 100755 --- a/common/scripts/bump.js +++ b/common/scripts/bump.js @@ -94,7 +94,20 @@ function main () { console.log('bump version ...', version) - const config = JSON.parse(execSync('rush list -p --json', { encoding: 'utf-8' })) + const output = execSync('node common/scripts/install-run-rush.js list -p --json', { encoding: 'utf-8', cwd: repoRoot }) + const lines = output.split('\n') + let jsonStart = -1 + for (let i = 0; i < lines.length; i++) { + if (lines[i].trim().startsWith('{')) { + jsonStart = i + break + } + } + if (jsonStart === -1) { + console.error('Could not find JSON output from rush list') + process.exit(1) + } + const config = JSON.parse(lines.slice(jsonStart).join('\n')) fillPackages(config) From b9cd6d8cc5b31a39909dd02d973974fd77c10b38 Mon Sep 17 00:00:00 2001 From: Artem Savchenko Date: Sun, 22 Feb 2026 20:22:42 +0700 Subject: [PATCH 2/2] Add permmission block Signed-off-by: Artem Savchenko --- .github/workflows/main.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index bbe62a46256..98672449f13 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -2,6 +2,9 @@ name: CI +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true