Skip to content

chore: add CI workflow + changesets release infrastructure - #16

Merged
sepehr-safari merged 1 commit into
mainfrom
chore/ci-release-workflow
Jul 7, 2026
Merged

chore: add CI workflow + changesets release infrastructure#16
sepehr-safari merged 1 commit into
mainfrom
chore/ci-release-workflow

Conversation

@sepehr-safari

Copy link
Copy Markdown
Member

Summary

Add GitHub Actions CI pipeline and Changesets release infrastructure.

What's included (Issues #5#6)

Issue #5 — GitHub Actions CI workflow:

  • .github/workflows/ci.yml
  • Jobs: install (pnpm frozen-lockfile), lint, format check, typecheck, test, build
  • Triggers: push to main, PR to main
  • Node 22, pnpm cached
  • Least-privilege permissions (contents: read)
  • Concurrency group with cancel-in-progress

Issue #6 — Changesets + release workflow:

  • .changeset/config.json (access: public, baseBranch: main)
  • .github/workflows/release.yml — Changesets version PR + npm publish + ecosystem tag + GitHub release
  • Release workflow only fires when version PR is merged (normal feature PR merges do not publish)
  • Ecosystem tag: release-v0.x.0 derived from highest published package version
  • Separate permissions block on release job: contents: write, pull-requests: write, id-token: write

Security

  • No script injection sinks (no ${{ github.event.* }} in run: blocks)
  • Least-privilege permissions blocks — top-level contents: read, release job scoped
  • NPM_TOKEN passed via env, not interpolated in shell
  • First-party actions on maintained tags

Verification

  • pnpm lint passes
  • pnpm test passes
  • pnpm format:check passes
  • npx changeset status works (no packages to bump yet — expected)
  • CI/release workflows are valid YAML

Closes #5, closes #6

- .github/workflows/ci.yml: lint, format check, typecheck, test, build
  on push to main and PRs to main. Node 22, pnpm cached, frozen lockfile.
  Least-privilege permissions (contents: read), concurrency cancellation.
- .github/workflows/release.yml: Changesets version PR + npm publish +
  ecosystem tag (release-v0.x.0) + GitHub release. Only fires when
  version PR is merged. Separate contents:write/pull-requests:write
  permissions scoped to release job only.
- .changeset/config.json: public access, base branch main

Closes #5, closes #6
@sepehr-safari sepehr-safari added type:chore Maintenance, tooling, or infrastructure package:repo Repository-level changes priority:critical Must be done before release labels Jul 7, 2026
@sepehr-safari
sepehr-safari merged commit 4482e75 into main Jul 7, 2026
1 check failed
@sepehr-safari
sepehr-safari deleted the chore/ci-release-workflow branch July 7, 2026 20:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

package:repo Repository-level changes priority:critical Must be done before release type:chore Maintenance, tooling, or infrastructure

Projects

None yet

Development

Successfully merging this pull request may close these issues.

chore: add changesets + release workflow chore: add GitHub Actions CI workflow

1 participant