Alternative preview "release" workflow

* Protect publishes with env gate

* tweak CODEOWNERS and release-pr

* remove redundant permission

* fix syntax

* Use app with protection bypass for publishing

* handle forks better

* remove redundant permission

.changeset/brown-cycles-attack.md

@@ -1,5 +0,0 @@
----
-"@changesets/action": minor
----
-
-Support draft version PR modes with a new `prDraft` input. Use `create` to create new version PRs as drafts, or `always` to also convert existing version PRs back to draft when updating them.

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+/.github/workflows/** @Andarist @emmatown
+/action.yml @Andarist @emmatown
+/scripts/bump.ts @Andarist @emmatown
+/scripts/release.ts @Andarist @emmatown
+/scripts/release-pr.ts @Andarist @emmatown

.github/actions/ci-setup/action.yml

@@ -4,7 +4,7 @@ runs:
   using: composite
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
       with:
         node-version-file: ".node-version"
         cache: yarn

.github/workflows/ci.yml

@@ -1,26 +1,46 @@
-name: Node CI
+name: CI
 
 on:
-  push:
-    branches:
-      - main
   pull_request:
+  push:
+    branches: [main]
+  merge_group:
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
-  build:
+  test:
+    name: Test
     timeout-minutes: 20
-
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
+      - uses: ./.github/actions/ci-setup
-          ref: ${{ github.event.pull_request.head.sha }}
 
+      - name: Test
+        run: yarn test
+
+  typecheck:
+    name: Typecheck
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/ci-setup
 
       - name: Typecheck
         run: yarn typecheck
 
-      - name: Test
+  ci-ok:
-        run: yarn test
+    name: CI OK
+    runs-on: ubuntu-latest
+    if: always()
+    needs: [test, typecheck]
+    steps:
+      - name: Exit with error if some jobs are not successful
+        run: exit 1
+        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled')) }}

.github/workflows/preview-release.yml

@@ -0,0 +1,33 @@
+name: Release Branch
+
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  release:
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/ci-setup
+
+      - run: yarn changeset version --snapshot branch-${{ github.ref_name }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build
+        run: yarn build
+
+      - name: Setup Git user
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Release snapshot version
+        run: yarn run release:pr
+        env:
+          GITHUB_REF_NAME: ${{ github.ref_name }}

.github/workflows/publish.yml

@@ -0,0 +1,62 @@
+name: Publish
+
+on:
+  push:
+    branches:
+      - main
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+permissions: {} # each job should define its own permission explicitly
+
+jobs:
+  version:
+    name: Version
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    outputs:
+      hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
+    permissions:
+      contents: write # to create release (changesets/action)
+      issues: write # to post issue comments (changesets/action)
+      pull-requests: write # to create pull request (changesets/action)
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/ci-setup
+
+      - name: Build
+        run: yarn build
+
+      - name: Create or update release pull request
+        id: changesets
+        uses: ./
+        with:
+          version: yarn bump
+
+  publish:
+    name: Publish
+    if: needs.version.outputs.hasChangesets == 'false'
+    needs: version
+    runs-on: ubuntu-latest
+    environment: marketplace
+    timeout-minutes: 20
+    steps:
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        id: app-token
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - uses: ./.github/actions/ci-setup
+
+      - name: Build
+        run: yarn build
+
+      - name: Publish to marketplace
+        uses: ./
+        with:
+          publish: yarn release

.github/workflows/release-pr.yml

@@ -1,102 +0,0 @@
-name: Release PR
-
-on:
-  issue_comment:
-    types: [created]
-
-jobs:
-  release_check:
-    if: github.repository == 'changesets/action' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/release-pr')
-    runs-on: ubuntu-latest
-    steps:
-      - id: report_in_progress
-        run: |
-          echo "in_progress_reaction_id=$(gh api /repos/${{github.repository}}/issues/comments/${{github.event.comment.id}}/reactions -f content='eyes' --jq '.id')" >> "$GITHUB_OUTPUT"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - id: check_authorization
-        run: |
-          if [[ $AUTHOR_ASSOCIATION == 'MEMBER' || $AUTHOR_ASSOCIATION == 'OWNER' || $AUTHOR_ASSOCIATION == 'COLLABORATOR' ]]
-          then
-            echo "User is authorized to release"
-          else
-            echo "User is not authorized to release"
-            exit 1
-          fi
-        env:
-          AUTHOR_ASSOCIATION: ${{ github.event.comment.author_association }}
-
-    outputs:
-      in_progress_reaction_id: ${{ steps.report_in_progress.outputs.in_progress_reaction_id }}
-
-  release:
-    if: github.repository == 'changesets/action'
-    timeout-minutes: 20
-    runs-on: ubuntu-latest
-    needs: release_check
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/ci-setup
-
-      - name: Checkout pull request
-        run: gh pr checkout ${{ github.event.issue.number }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Check if Version Packages PR
-        id: check_version_packages
-        run: |
-          echo "version_packages=$(gh pr view ${{ github.event.issue.number }} --json headRefName --jq '.headRefName|startswith("changeset-release/")')" >> "$GITHUB_OUTPUT"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Reset Version Packages PR
-        if: steps.check_version_packages.outputs.version_packages == 'true'
-        run: git reset --hard HEAD~1
-
-      - run: yarn changeset version --snapshot pr${{ github.event.issue.number }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build
-        run: yarn build
-
-      - name: Setup Git user
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-      - name: Release snapshot version
-        run: yarn run release:pr
-
-      - run: gh api /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions -f content='rocket'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - run: gh api -X DELETE /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions/${{ needs.release_check.outputs.in_progress_reaction_id }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - run: gh pr comment ${{ github.event.issue.number }} --body "The [${{ github.repository }}@$(git rev-parse HEAD)](https://github.com/${{ github.repository }}/commit/$(git rev-parse HEAD)) release triggered by [this comment](${{ github.event.comment.url }}) has [succeeded](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})."
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  report-failure-if-needed:
-    needs: [release_check, release]
-    timeout-minutes: 2
-    runs-on: ubuntu-latest
-    if: failure() && github.repository == 'changesets/action' && (needs.release_check.result == 'failure' || needs.release.result == 'failure')
-    steps:
-      - run: gh api /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions -f content='-1'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - run: gh api -X DELETE /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions/${{ needs.release_check.outputs.in_progress_reaction_id }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - run: gh pr comment ${{ github.event.issue.number }} --body "The release triggered by [this comment](${{ github.event.comment.url }}) has [failed](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})."
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}

.github/workflows/version-or-publish.yml

@@ -1,27 +0,0 @@
-name: Version or Publish
-
-on:
-  push:
-    branches:
-      - main
-
-concurrency: ${{ github.workflow }}-${{ github.ref }}
-
-jobs:
-  changesets:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/ci-setup
-
-      - name: Build
-        run: yarn build
-
-      - name: Create Release Pull Request or Publish
-        id: changesets
-        uses: ./
-        with:
-          version: yarn bump
-          publish: yarn release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -14,7 +14,6 @@ This action for [Changesets](https://github.com/changesets/changesets) creates a
 - createGithubReleases - A boolean value to indicate whether to create Github releases after `publish` or not. Default to `true`
 - commitMode - Specifies the commit mode. Use `"git-cli"` to push changes using the Git CLI, or `"github-api"` to push changes via the GitHub API. When using `"github-api"`, all commits and tags are GPG-signed and attributed to the user or app who owns the `GITHUB_TOKEN`. Default to `git-cli`.
 - cwd - Changes node's `process.cwd()` if the project is not located on the root. Default to `process.cwd()`
-- prDraft - Controls draft PR behavior. Use `create` to create new version PRs as draft, or `always` to also convert existing version PRs back to draft when updating them. By default, version PRs are not forced into draft mode.
 
 ### Outputs
 

action.yml

@@ -43,9 +43,6 @@ inputs:
   branch:
     description: Sets the branch in which the action will run. Default to `github.ref_name` if not provided
     required: false
-  prDraft:
-    description: 'Controls draft PR behavior. Use "create" to create new version PRs as draft, or "always" to also convert existing version PRs back to draft when updating them.'
-    required: false
 outputs:
   published:
     description: A boolean value to indicate whether a publishing is happened or not

scripts/release-pr.ts

@@ -4,7 +4,7 @@ import path from "node:path";
 import pkgJson from "../package.json" with { type: "json" };
 
 const tag = `v${pkgJson.version}`;
-const releaseLine = "pr-release";
+const releaseLine = `built-${process.env.GITHUB_REF_NAME}`;
 
 process.chdir(path.join(import.meta.dirname, ".."));
 

src/__snapshots__/run.test.ts.snap

@@ -1,28 +1,5 @@
 // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
-exports[`version > creates a draft PR when prDraft is "create" 1`] = `
-[
-  {
-    "base": "some-branch",
-    "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
-
-
-# Releases
-## simple-project-pkg-a@1.1.0
-
-### Minor Changes
-
--   Awesome feature
-",
-    "draft": true,
-    "head": "changeset-release/some-branch",
-    "owner": "changesets",
-    "repo": "action",
-    "title": "Version Packages",
-  },
-]
-`;
-
 exports[`version > creates simple PR 1`] = `
 [
   {
@@ -48,7 +25,6 @@ exports[`version > creates simple PR 1`] = `
 
 -   Awesome feature
 ",
-    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -67,7 +43,6 @@ exports[`version > does not include any release information if a message with si
 # Releases
 
 > All release information have been omitted from this message, as the content exceeds the size limit.",
-    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -90,7 +65,6 @@ exports[`version > does not include changelog entries if full message exceeds si
 ## simple-project-pkg-a@1.1.0
 
 ",
-    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -113,7 +87,6 @@ exports[`version > doesn't include ignored package that got a dependency update
 
 -   Awesome feature
 ",
-    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -136,7 +109,6 @@ exports[`version > only includes bumped packages in the PR body 1`] = `
 
 -   Awesome feature
 ",
-    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -144,94 +116,3 @@ exports[`version > only includes bumped packages in the PR body 1`] = `
   },
 ]
 `;
-
-exports[`version > updates an existing PR via GraphQL and converts it to draft when prDraft is "always" 1`] = `
-[
-  "
-      mutation UpdatePullRequest(
-        $pullRequestId: ID!
-        $title: String!
-        $body: String!
-      ) {
-        
-        convertPullRequestToDraft(
-          input: {
-            pullRequestId: $pullRequestId
-          }
-        ) {
-          pullRequest {
-            id
-          }
-        }
-
-        updatePullRequest(
-          input: {
-            pullRequestId: $pullRequestId
-            title: $title
-            body: $body
-            state: OPEN
-          }
-        ) {
-          pullRequest {
-            id
-          }
-        }
-      }
-    ",
-  {
-    "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
-
-
-# Releases
-## simple-project-pkg-a@1.1.0
-
-### Minor Changes
-
--   Awesome feature
-",
-    "pullRequestId": "PR_kwDOA",
-    "title": "Version Packages",
-  },
-]
-`;
-
-exports[`version > updates an existing PR via GraphQL without converting it to draft when prDraft is "create" 1`] = `
-[
-  "
-      mutation UpdatePullRequest(
-        $pullRequestId: ID!
-        $title: String!
-        $body: String!
-      ) {
-        
-
-        updatePullRequest(
-          input: {
-            pullRequestId: $pullRequestId
-            title: $title
-            body: $body
-            state: OPEN
-          }
-        ) {
-          pullRequest {
-            id
-          }
-        }
-      }
-    ",
-  {
-    "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
-
-
-# Releases
-## simple-project-pkg-a@1.1.0
-
-### Minor Changes
-
--   Awesome feature
-",
-    "pullRequestId": "PR_kwDOA",
-    "title": "Version Packages",
-  },
-]
-`;

src/index.ts

@@ -24,15 +24,10 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
 
   const octokit = setupOctokit(githubToken);
   const commitMode = getOptionalInput("commitMode") ?? "git-cli";
-  const prDraft = getOptionalInput("prDraft");
   if (commitMode !== "git-cli" && commitMode !== "github-api") {
     core.setFailed(`Invalid commit mode: ${commitMode}`);
     return;
   }
-  if (prDraft !== undefined && prDraft !== "always" && prDraft !== "create") {
-    core.setFailed(`Invalid prDraft: ${prDraft}`);
-    return;
-  }
   const git = new Git({
     octokit: commitMode === "github-api" ? octokit : undefined,
     cwd,
@@ -152,7 +147,6 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
         prTitle: getOptionalInput("title"),
         commitMessage: getOptionalInput("commit"),
         hasPublishScript,
-        prDraft,
         branch: getOptionalInput("branch"),
       });
 

src/run.test.ts

@@ -19,7 +19,6 @@ vi.mock("@actions/github", () => ({
   },
   getOctokit: () => ({
     rest: mockedGithubMethods,
-    graphql: mockedGraphql,
   }),
 }));
 vi.mock("./git.ts");
@@ -34,7 +33,6 @@ let mockedGithubMethods = {
     createRelease: vi.fn(),
   },
 };
-let mockedGraphql = vi.fn();
 
 let f = fixturez(import.meta.dirname);
 
@@ -92,42 +90,6 @@ describe("version", () => {
     expect(mockedGithubMethods.pulls.create.mock.calls[0]).toMatchSnapshot();
   });
 
-  it('creates a draft PR when prDraft is "create"', async () => {
-    let cwd = f.copy("simple-project");
-    await linkNodeModules(cwd);
-
-    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
-
-    mockedGithubMethods.pulls.create.mockImplementationOnce(() => ({
-      data: { number: 123 },
-    }));
-
-    await writeChangesets(
-      [
-        {
-          releases: [
-            {
-              name: "simple-project-pkg-a",
-              type: "minor",
-            },
-          ],
-          summary: "Awesome feature",
-        },
-      ],
-      cwd
-    );
-
-    await runVersion({
-      octokit: setupOctokit("@@GITHUB_TOKEN"),
-      githubToken: "@@GITHUB_TOKEN",
-      git: new Git({ cwd }),
-      cwd,
-      prDraft: "create",
-    });
-
-    expect(mockedGithubMethods.pulls.create.mock.calls[0]).toMatchSnapshot();
-  });
-
   it("only includes bumped packages in the PR body", async () => {
     let cwd = f.copy("simple-project");
     await linkNodeModules(cwd);
@@ -315,72 +277,4 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
       /All release information have been omitted from this message, as the content exceeds the size limit/
     );
   });
-
-  it('updates an existing PR via GraphQL without converting it to draft when prDraft is "create"', async () => {
-    let cwd = f.copy("simple-project");
-    await linkNodeModules(cwd);
-
-    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({
-      data: [{ number: 123, node_id: "PR_kwDOA" }],
-    }));
-
-    await writeChangesets(
-      [
-        {
-          releases: [
-            {
-              name: "simple-project-pkg-a",
-              type: "minor",
-            },
-          ],
-          summary: "Awesome feature",
-        },
-      ],
-      cwd
-    );
-
-    await runVersion({
-      octokit: setupOctokit("@@GITHUB_TOKEN"),
-      githubToken: "@@GITHUB_TOKEN",
-      git: new Git({ cwd }),
-      cwd,
-      prDraft: "create",
-    });
-
-    expect(mockedGraphql.mock.calls[0]).toMatchSnapshot();
-  });
-
-  it('updates an existing PR via GraphQL and converts it to draft when prDraft is "always"', async () => {
-    let cwd = f.copy("simple-project");
-    await linkNodeModules(cwd);
-
-    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({
-      data: [{ number: 123, node_id: "PR_kwDOA" }],
-    }));
-
-    await writeChangesets(
-      [
-        {
-          releases: [
-            {
-              name: "simple-project-pkg-a",
-              type: "minor",
-            },
-          ],
-          summary: "Awesome feature",
-        },
-      ],
-      cwd
-    );
-
-    await runVersion({
-      octokit: setupOctokit("@@GITHUB_TOKEN"),
-      githubToken: "@@GITHUB_TOKEN",
-      git: new Git({ cwd }),
-      cwd,
-      prDraft: "always",
-    });
-
-    expect(mockedGraphql.mock.calls[0]).toMatchSnapshot();
-  });
 });

src/run.ts

@@ -259,7 +259,6 @@ type VersionOptions = {
   commitMessage?: string;
   hasPublishScript?: boolean;
   prBodyMaxCharacters?: number;
-  prDraft?: "always" | "create";
   branch?: string;
 };
 
@@ -278,7 +277,6 @@ export async function runVersion({
   hasPublishScript = false,
   prBodyMaxCharacters = MAX_CHARACTERS_PER_MESSAGE,
   branch = github.context.ref.replace("refs/heads/", ""),
-  prDraft,
 }: VersionOptions): Promise<RunVersionResult> {
   let versionBranch = `changeset-release/${branch}`;
 
@@ -378,7 +376,6 @@ export async function runVersion({
       head: versionBranch,
       title: finalPrTitle,
       body: prBody,
-      draft: prDraft !== undefined,
       ...github.context.repo,
     });
 
@@ -389,46 +386,12 @@ export async function runVersion({
     const [pullRequest] = existingPullRequests.data;
 
     core.info(`updating found pull request #${pullRequest.number}`);
-    const convertPullRequestToDraftMutation =
+    await octokit.rest.pulls.update({
-      prDraft === "always"
+      pull_number: pullRequest.number,
-        ? `
-        convertPullRequestToDraft(
-          input: {
-            pullRequestId: $pullRequestId
-          }
-        ) {
-          pullRequest {
-            id
-          }
-        }`
-        : "";
-    const updatePullRequestMutation = `
-      mutation UpdatePullRequest(
-        $pullRequestId: ID!
-        $title: String!
-        $body: String!
-      ) {
-        ${convertPullRequestToDraftMutation}
-
-        updatePullRequest(
-          input: {
-            pullRequestId: $pullRequestId
-            title: $title
-            body: $body
-            state: OPEN
-          }
-        ) {
-          pullRequest {
-            id
-          }
-        }
-      }
-    `;
-
-    await octokit.graphql(updatePullRequestMutation, {
-      pullRequestId: pullRequest.node_id,
       title: finalPrTitle,
       body: prBody,
+      ...github.context.repo,
+      state: "open",
     });
 
     return {