@catladder/cli 0.0.0-main-a6b45abe → 0.0.0-main-fd9c5f51

package/src/release/changesetsReleaseJob.ts

@@ -6,7 +6,8 @@
  * pushes — the pushed tag triggers the taggedRelease pipeline.
  */
 import { existsSync } from "fs";
-import { readFile, readdir, rm, writeFile } from "fs/promises";
+import { mkdtemp, readFile, readdir, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
 import { join } from "path";
 import type { Changeset } from "./changesets";
 import {
@@ -16,7 +17,12 @@ import {
   prependToChangelog,
   renderChangelogEntries,
 } from "./changesets";
-import { ensureReleaseHistory, getLastReleaseTag, git } from "./releaseGit";
+import {
+  ensureReleaseHistory,
+  getLastReleaseTag,
+  git,
+  gitWithEnv,
+} from "./releaseGit";
 import { appendStepSummary } from "./stepSummary";
 
 const CHANGESET_DIR = ".changeset";
@@ -75,8 +81,12 @@ const requireEnv = (name: string): string => {
  * - gitlab: CI checkouts have a read-only origin, so push via an
  *   authenticated url with GL_TOKEN (the same project access token
  *   semantic-release uses)
- * - github: actions/checkout persists the job token credentials, so a
- *   plain push to origin works (`permissions: contents: write`)
+ * - github: over ssh with the release deploy key
+ *   (CATLADDER_RELEASE_KEY, provisioned by `project setup`) — merge
+ *   gating requires the `catladder ✅` check on the default branch,
+ *   and only a deploy key can bypass that (github deliberately never
+ *   lets the workflow token bypass rulesets). Without the secret the
+ *   push falls back to origin, which works on repos without gating.
  */
 const pushCommitAndTag = async (tag: string) => {
   // --atomic: all refs or none — a rejected tag must not leave the
@@ -84,7 +94,29 @@ const pushCommitAndTag = async (tag: string) => {
   // rederived an existing version)
   if (process.env.GITHUB_ACTIONS === "true") {
     const branch = requireEnv("GITHUB_REF_NAME");
-    await git("push", "--atomic", "origin", `HEAD:refs/heads/${branch}`, tag);
+    const refs = [`HEAD:refs/heads/${branch}`, tag];
+    const deployKey = process.env.CATLADDER_RELEASE_KEY;
+    if (deployKey) {
+      await pushWithDeployKey(deployKey, refs);
+      return;
+    }
+    try {
+      await git("push", "--atomic", "origin", ...refs);
+    } catch (e) {
+      // GH006: a required status check rejects the fresh release
+      // commit (it cannot have a passing check yet) — the push needs
+      // the release deploy key, which `project setup` provisions
+      if (/GH006|protected branch/i.test(`${e?.message ?? e}`)) {
+        throw new Error(
+          `pushing the release to '${branch}' was rejected by its branch protection:\n` +
+            `${e.message}\n` +
+            `The workflow token cannot bypass a required status check on '${branch}'. ` +
+            `Run \`catladder project setup\` to provision the release deploy key ` +
+            `(${RELEASE_KEY_ENV} secret + ruleset bypass), then rerun this job.`,
+        );
+      }
+      throw e;
+    }
     return;
   }
   const token = requireEnv("GL_TOKEN");
@@ -95,6 +127,41 @@ const pushCommitAndTag = async (tag: string) => {
   await git("push", "--atomic", remote, `HEAD:refs/heads/${branch}`, tag);
 };
 
+const RELEASE_KEY_ENV = "CATLADDER_RELEASE_KEY";
+
+/**
+ * pushes over ssh with the release deploy key — the only actor that
+ * can bypass the merge-gating ruleset on the default branch
+ */
+const pushWithDeployKey = async (privateKey: string, refs: string[]) => {
+  const serverUrl = process.env.GITHUB_SERVER_URL ?? "https://github.com";
+  const host = new URL(serverUrl).host;
+  const repository = requireEnv("GITHUB_REPOSITORY");
+  const dir = await mkdtemp(join(tmpdir(), "release-key-"));
+  try {
+    const keyFile = join(dir, "id_ed25519");
+    // a key file without a trailing newline is rejected by openssh
+    await writeFile(
+      keyFile,
+      privateKey.endsWith("\n") ? privateKey : `${privateKey}\n`,
+      {
+        mode: 0o600,
+      },
+    );
+    await gitWithEnv(
+      {
+        GIT_SSH_COMMAND: `ssh -i ${keyFile} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new`,
+      },
+      "push",
+      "--atomic",
+      `git@${host}:${repository}.git`,
+      ...refs,
+    );
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+};
+
 /**
  * tags pushed with the default GITHUB_TOKEN do not trigger `on: push:
  * tags` workflows (github's recursion guard), so the taggedRelease
@@ -196,7 +263,15 @@ export const changesetsReleaseJob = async () => {
   } else {
     await git("add", CHANGELOG_FILE, CHANGESET_DIR);
   }
-  await git("commit", "-m", `chore(release): ${version}\n\n${entries}`);
+  // [skip ci] on github only: deploy-key pushes trigger workflows
+  // (unlike GITHUB_TOKEN pushes), and neither the release commit nor
+  // the tag needs a push-triggered run — the taggedRelease workflow is
+  // dispatched explicitly below, [skip ci] keeps it the only run. On
+  // gitlab the tag pipeline MUST fire natively, so no marker there
+  // (release-commit branch pipelines are already filtered by rules).
+  const onGithub = process.env.GITHUB_ACTIONS === "true";
+  const subject = `chore(release): ${version}${onGithub ? " [skip ci]" : ""}`;
+  await git("commit", "-m", `${subject}\n\n${entries}`);
   await git("tag", tag);
   await pushCommitAndTag(tag);
   console.log(`released ${tag}`);

package/src/release/releaseGit.ts

@@ -12,6 +12,17 @@ export const git = async (...args: string[]): Promise<string> => {
   return stdout.trim();
 };
 
+/** like `git`, but with extra environment variables (e.g. GIT_SSH_COMMAND) */
+export const gitWithEnv = async (
+  env: Record<string, string>,
+  ...args: string[]
+): Promise<string> => {
+  const { stdout } = await execFile("git", args, {
+    env: { ...process.env, ...env },
+  });
+  return stdout.trim();
+};
+
 /**
  * CI checkouts are usually shallow and tagless (gitlab clones with
  * depth 1; github's checkout needs fetch-depth: 0) — the local history

package/src/utils/github.ts

@@ -170,7 +170,7 @@ export const ensureGithubEnvironment = async (
 
 /** runs `gh api` with an optional JSON body and returns the parsed response */
 export const ghApiJson = async <T = any>(
-  method: "GET" | "PATCH" | "PUT",
+  method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE",
   path: string,
   body?: unknown,
 ): Promise<T> => {