Release Workflow: Remove pnpm cache, Automate Release, Pin All Actions by SHA, Add Summary

[mazipan-wego]

🔒 Release Workflow Improvements for .github/workflows/publish.yml

Background & Motivation

Our workflow pins all GitHub Actions by commit hash for security and reliability. Several improvements are required for our publish process for best practices, safety, and automation:

---

1. Remove pnpm Cache from Release Workflow

• Why: Recent incidents (see TanStack/query discussion, Adam Klein on Twitter) show pnpm cache can cause broken releases.
• Action: Set cache: false in the pnpm/action-setup step.

Before:

      - name: Set up pnpm
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
        with:
          run_install: false
          cache: true

After:

      - name: Set up pnpm
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
        with:
          run_install: false
          cache: false # Critical: See https://github.com/TanStack/query/discussions/6572#discussioncomment-9760676

---

2. Automate GitHub Release Page Creation (No Tags!)

• Goal: When a tag is pushed, create a corresponding GitHub Release page, not a new tag.
• How: Use softprops/action-gh-release, pinned by commit SHA just like other actions. Do NOT use @v2 or a branch ref!
• Sample Snippet:
  • (Get latest commit SHA: https://github.com/softprops/action-gh-release/releases)

      - name: Create GitHub Release Page
        uses: softprops/action-gh-release@6e4caec7c1d1783b038b4e2e3b6a5c628413deb8 # update to latest sha if needed
        with:
          tag_name: ${{ github.ref_name }} # Uses the tag that triggered this workflow
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

• This step only creates the release page for the existing tag: it will NOT create/overwrite tags.

---

3. Add GitHub Actions Job Summary

• Goal: Write a summary to the Actions run log for easier release auditing.

Example:

      - name: Output GitHub Action Summary
        run: |
          echo "## :rocket: Publish Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- Tag: \`${{ github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
          echo "- npm publish status: Success" >> $GITHUB_STEP_SUMMARY
          echo "- Release: [GitHub Release](https://github.com/${{ github.repository }}/releases/tag/${{ github.ref_name }})" >> $GITHUB_STEP_SUMMARY

---

🔒 Pin All Actions by Commit Hash

• This includes softprops/action-gh-release, following current practice (e.g., already done for checkout/setup-node/pnpm). See GitHub guidance.

---

📝 Reference

• Kwiket/jets-seatmap-react-lib-pub/.github/workflows/publish.yml

---

Let me know if you want a PR for these improvements or need further adjustments!