@catladder/cli 0.0.0-next-401fe684 → 0.0.0-next-23a53e9e

package/dist/pipeline/src/types/release.d.ts

@@ -1,7 +1,25 @@
+/**
+ * how releases are created:
+ * - "semantic-release" (default): the version is derived automatically
+ *   from conventional commit messages since the last release
+ * - "changesets": developers declare changes intentionally as
+ *   `.changeset/*.md` files (bump type + human-written summary,
+ *   official changesets format); the release job consumes them and
+ *   derives the version from the last `v*` git tag
+ *
+ * Both methods gate on the security audit, commit a changelog and push
+ * a `vX.Y.Z` tag that triggers the taggedRelease pipeline.
+ */
+export type ReleaseMethod = "semantic-release" | "changesets";
 export type ReleaseConfig = {
   /**
    * Whether to release automatically or manually on main branch.
    * Defaults to "manuel"
    */
   when?: "manual" | "auto";
+  /**
+   * how the release version and changelog are created.
+   * Defaults to "semantic-release".
+   */
+  method?: ReleaseMethod;
 };

package/dist/runner-images/changesets/Dockerfile

@@ -0,0 +1,13 @@
+FROM node:lts-alpine
+
+RUN apk add --no-cache bash git git-lfs
+
+# no release tooling baked in: the changesets release logic lives in
+# catci, which is materialized into the repository checkout
+# (.catladder-generated/catci) by pipeline generation
+
+RUN mkdir -p /scripts
+COPY ./scripts/* /scripts/
+RUN chmod +x /scripts/*
+
+ENV PATH="/scripts:${PATH}"

package/dist/runner-images/changesets/scripts/changesetsRelease

@@ -0,0 +1,37 @@
+#!/bin/bash
+set -e
+
+# 0. check and evaluate security audit or create MR with security audit template (and exit 1)
+# 1. compute the next version from the last v* tag + pending .changeset/*.md files
+# 2. write the changelog, commit, tag and push (all done by catci)
+
+# NOTE: keep the security-audit gate below in sync with
+# runner-images/semantic-release/scripts/semanticRelease
+
+if [ "$GITHUB_ACTIONS" = "true" ]; then
+  # github container jobs: the workspace volume is owned by the host
+  # runner user while this step runs as the container user, and the
+  # safe.directory entry actions/checkout writes goes to a temporary
+  # HOME that is gone by now — git would refuse the repo ("dubious
+  # ownership")
+  git config --global --add safe.directory "$(pwd)"
+fi
+
+echo "doing security audit check"
+CATCI=".catladder-generated/catci/index.js"
+if [ -f "$CATCI" ]; then
+  # catci is materialized by pipeline generation — always the exact
+  # catladder version that generated this pipeline
+  if [ "$GITHUB_ACTIONS" = "true" ]; then
+    # github: gate only — the MR remediation is gitlab-specific
+    node "$CATCI" security-audit check ./
+  else
+    node "$CATCI" security-audit ci-job ./ "$GL_TOKEN" "$CI_DEFAULT_BRANCH" "$CI_PROJECT_ID" "$GITLAB_USER_ID"
+  fi
+else
+  echo "$CATCI not found — regenerate the pipeline with a current catladder version (catenv)"
+  exit 1
+fi
+
+echo "doing changesets release"
+node "$CATCI" release changesets

package/dist/runner-images/semantic-release/Dockerfile

@@ -7,6 +7,10 @@ FROM node:22-alpine
 RUN apk add --no-cache bash git git-lfs
 
 # add semantic release
+# NOTE: keep every plugin pinned to a major that is compatible with
+# semantic-release@19 (they declare `semantic-release` as a peer dependency).
+# Unpinned plugins drift to their latest major on image rebuild, which now
+# requires semantic-release>=20 and fails with "plugins configuration is invalid".
 RUN yarn global add \
     semantic-release@19.0.5 \
     @semantic-release/commit-analyzer@13.0.1 \

package/dist/runner-images/semantic-release/scripts/semanticRelease

@@ -8,6 +8,15 @@ set -e
 
 # better branches settings: https://github.com/semantic-release/semantic-release/issues/1581
 
+if [ "$GITHUB_ACTIONS" = "true" ]; then
+  # github container jobs: the workspace volume is owned by the host
+  # runner user while this step runs as the container user, and the
+  # safe.directory entry actions/checkout writes goes to a temporary
+  # HOME that is gone by now — git would refuse the repo ("dubious
+  # ownership", surfacing as ENOGITREPO from semantic-release)
+  git config --global --add safe.directory "$(pwd)"
+fi
+
 echo "doing security audit check"
 CATCI=".catladder-generated/catci/index.js"
 if [ -f "$CATCI" ]; then
@@ -30,6 +39,18 @@ fi
 
 echo "doing semantic release"
 
+if [ "$GITHUB_ACTIONS" = "true" ]; then
+  # the gitlab publish plugin would fail on github; skip it (the tag
+  # and changelog commit still happen, only the gitlab release entry
+  # is gitlab-specific)
+  PUBLISH_PLUGIN=""
+else
+  PUBLISH_PLUGIN=',
+    ["@semantic-release/gitlab", {
+      "gitlabUrl": "https://git.panter.ch"
+    }]'
+fi
+
 if [ ! -e .releaserc ]; then
   cat >.releaserc <<EOF
 {
@@ -58,10 +79,7 @@ if [ ! -e .releaserc ]; then
     "@semantic-release/changelog",
     ["@semantic-release/git", {
       "message": "chore(\${branch.type}): \${nextRelease.version}\n\n\${nextRelease.notes}"
-    }],
-    ["@semantic-release/gitlab", {
-      "gitlabUrl": "https://git.panter.ch"
-    }]
+    }]${PUBLISH_PLUGIN}
     ],
   "branches": [
     "+([0-9])?(.{+([0-9]),x}).x",
@@ -81,4 +99,25 @@ if [ ! -e .releaserc ]; then
 }
 EOF
 fi
+
+if [ "$GITHUB_ACTIONS" = "true" ]; then
+  TAGS_BEFORE=$(git tag --list 'v[0-9]*')
+fi
+
 semantic-release
+
+# tags pushed with the default GITHUB_TOKEN don't trigger `on: push:
+# tags` workflows (github's recursion guard) — dispatch the
+# taggedRelease workflow explicitly for a tag semantic-release created
+if [ "$GITHUB_ACTIONS" = "true" ] && [ -f "$CATCI" ]; then
+  if [ -z "$TAGS_BEFORE" ]; then
+    NEW_TAG=$(git tag --list 'v[0-9]*' | tail -n1)
+  else
+    NEW_TAG=$(git tag --list 'v[0-9]*' | grep -Fxv -f <(printf '%s\n' "$TAGS_BEFORE") | tail -n1 || true)
+  fi
+  if [ -n "$NEW_TAG" ]; then
+    node "$CATCI" release dispatch-tagged-workflow "$NEW_TAG"
+  else
+    echo "no new release tag created — skipping taggedRelease dispatch"
+  fi
+fi