release-prep.yml

name: Release prep

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release, without the leading v (for example 1.8.0)'
        required: true
        type: string

# Every write goes through the app token below. GITHUB_TOKEN needs no scope of
# its own, and a pull request it opened would start no checks.
permissions: {}

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  prep:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Mint a token for the release app
        id: app
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        with:
          client-id: ${{ secrets.RELEASE_APP_CLIENT_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - name: Checkout default branch
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: '24'

      # Dates the section, writes the compare link and bumps api/package.json.
      - name: Prepare the release
        env:
          VERSION: ${{ inputs.version }}
        run: node scripts/release-prep.js "$VERSION"

      # The same gate the pull request will run, failing here instead of after
      # a branch exists.
      - name: Check the changelog
        env:
          VERSION: ${{ inputs.version }}
        run: node scripts/changelog-check.js --release "$VERSION"

      - name: Open the release pull request
        env:
          VERSION: ${{ inputs.version }}
          BASE: ${{ github.event.repository.default_branch }}
          REPO: ${{ github.repository }}
          GH_TOKEN: ${{ steps.app.outputs.token }}
        run: |
          set -euo pipefail
          BRANCH="release/v${VERSION}"
          git config user.name 'SandObserver'
          git config user.email '260779319+SandObserver@users.noreply.github.com'
          git checkout -b "${BRANCH}"
          git add CHANGELOG.md api/package.json
          git commit -m "Release ${VERSION}"
          git push "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" "HEAD:${BRANCH}"
          gh pr create \
            --base "${BASE}" \
            --head "${BRANCH}" \
            --title "Release: ${VERSION}" \
            --label release \
            --body "$(printf '%s\n' \
              '**Summary**' \
              "- Date Unreleased as ${VERSION} and add its compare link." \
              "- Bump api/package.json to ${VERSION}." \
              '' \
              '**Testing**' \
              'The changelog gate ran in release mode before this branch was pushed. Merging this tags the release and publishes the image.' \
              '' \
              '**Checklist**' \
              '- [x] Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).' \
              '- [ ] Tests added or updated for new logic, and the full suite, lint, and typechecks pass.' \
              '- [ ] Docs updated if behavior or configuration changed.')"