feat: changesets-based release automation - #1069
Open
abhithesys wants to merge 3 commits into
Open
Conversation
- .changeset/config.json: changelog-github, independent versioning with updateInternalDependencies=patch, two fixed groups (lang family: lang-core/react-lang/svelte-lang/vue-lang; UI pair: react-headless/react-ui), private packages never versioned, bumpVersionsWithWorkspaceProtocolOnly. - release.yml: on push to main, changesets/action (SHA-pinned v2.1.1) maintains the Version Packages PR; merging it builds in workspace order and runs changeset publish with npm OIDC trusted publishing, tags, and GitHub Releases. - changeset-check.yml + scripts/changeset-check.mjs: non-blocking PR check — warns on missing changesets, on range-breaking 0.x bumps (with fixed-group and cascade impact), and on breaking bumps to peer targets whose dependents' peer windows are untouched. - Internal peerDependencies converted from workspace: protocol to bounded tested-compatibility windows (react-ui, assistant-ui, devtools, react-email), with mirrored workspace:^ devDependencies for local linking; windows written against the first train's unified versions (0.3.0 lang / 0.14.0 UI). - Seed changesets: minor for both fixed groups (version unification), patch for the three peer-window packages. - CONTRIBUTING + .changeset/README document the changeset workflow. Design: docs/openui-release-management.md (all-repos docs). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Sync five manifest versions to npm registry state (devtools 0.1.0, react-lang 0.2.15, react-headless 0.9.12, react-ui 0.13.9, langchain 0.0.3): drift from the manual publish era would have made the first train compute already-published versions (devtools 0.0.9 is taken; a later publish would drag the latest dist-tag backwards). - release.yml: move the compound version command into a version:ci package script (changesets/action execs without a shell, so '&&' was a literal argument); install with --ignore-scripts (version path needs no builds; publish builds explicitly); document the GITHUB_TOKEN no-CI-on-version-PR limitation. - react-email's peer-window changeset is now minor, not patch: the new react-lang >=0.3.0 floor is breaking, and a floating 0.2.5 patch would have ERESOLVE'd existing ^0.2.4 consumers. - New scripts/verify-peer-windows.mjs wired into release:publish: asserts every internal bounded peer range contains the workspace sibling's version at publish time, turning stale windows into loud publish failures. - changeset-check hardening: top-level try/catch + continue-on-error (the informational check can no longer go red); deleted changesets no longer count as coverage; per-package coverage replaces all-or-nothing; CRLF and quoted frontmatter parse; unknown package names get an explicit warning; 0.0.x packages treat every bump as range-escaping; cascades follow only workspace:-protocol deps and expand fixed groups to a fixpoint. - build:packages root script shared by build-js.yml and release:publish so the CI-validated and published build commands cannot drift; deprecation header on publish-npm-package.yml. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
abhithesys
changed the base branch from
main
to
abhishek/release-mgmt-1-hygiene
August 25, 2026 10:18
…mgmt-2-changesets # Conflicts: # pnpm-lock.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces manual, per-package, hand-bumped publishing with a changesets flow: contributors add changeset files in PRs; on push to
main, CI maintains a Version Packages PR; merging it publishes to npm (OIDC), tags, and creates GitHub Releases.Versioning model
workspace:^runtime deps (updateInternalDependencies: "patch").lang-core/react-lang/svelte-lang/vue-lang(all bindings share one version with the core) andreact-headless/react-ui(react-uiexport *s react-headless).browser-bundledeliberately releases only by cascade.workspace:protocol to hand-maintained bounded windows (e.g.">=0.3.0 <0.4.0"), because changesets major-bumps peer-dependents on every peer range rewrite — react-lang is a peer of 4 packages including react-ui, so the default behavior would perpetually major-bump most of the lineup. Mirroredworkspace:^devDependencies keep local dev linked. The windows are written against the first train's versions (0.3.0 / 0.14.0), intentionally ahead of today's manifests — see the guard below.Safety mechanisms
scripts/verify-peer-windows.mjsruns first inrelease:publish: asserts every internal peer window contains the workspace sibling's version at publish time. A stale window fails the publish loudly instead of shipping an uninstallable package.scripts/changeset-check.mjs+changeset-check.yml: non-blocking PR check (crash-proof,continue-on-error) that warns on: packages changed that no changeset would release; range-escaping bumps (any bump on 0.0.x, minor+ on 0.x) with fixed-group and cascade impact; and breaking bumps to peer targets whose dependents' windows weren't moved in the same PR.latest), so the first train cannot compute already-published versions. This matters becausechangeset publishsilently skips versions that already exist — and the next publish after a skip would drag thelatestdist-tag backwards.First train (verified via
changeset versiondry-run)lang family → 0.3.0, UI pair → 0.14.0 (react-headless jumps from 0.9.12 to match react-ui), devtools → 0.1.1, react-email → 0.3.0 (minor: its new react-lang floor is breaking — a floating patch would ERESOLVE existing
^0.2.4consumers), assistant-ui → 0.0.4, browser-bundle → 0.1.2. Everything else untouched. The first automated release also creates the repo's first git tags and CHANGELOG.md files — no backfill.Known limitations / follow-ups
GITHUB_TOKEN, so no CI runs on it (documented inrelease.yml; swap in a PAT/App token if required checks onmainare needed).publish-npm-package.ymlcarries a deprecation header; delete after the first automated release succeeds. Until then, avoid dispatching it for react-ui / assistant-ui / devtools / react-email — their peer windows reference versions that don't exist on npm until the first train lands.release.ymlas trusted publisher for all 14 packages on npmjs.com (OIDC registration is per-workflow-filename; existing registrations only cover the old workflow).Reviewer checklist
.changeset/config.json— the fixed groups andbumpVersionsWithWorkspaceProtocolOnly: trueare the load-bearing settings.react-ui/assistant-ui/devtools/react-emailmanifests (net diff is windows + mirrored devDeps only; version bumps came in via main).release.yml— note the action executes its inputs without a shell, hence the compound commands live inversion:ci/release:publishpackage scripts.pnpm-lock.yamlchurn is format migration (pnpm 9 → 10.33 lockfile written by the pinned version from PR 1) plus the peer/devDep edits — no dependency version changes.