@mnci/cli 1.8.0 → 1.9.0

package/README.md

@@ -291,7 +291,16 @@ lint,test,build`. Pushes to `main` then:
   the raw token twine needs for the Python publish. Skipped cleanly when there
   is nothing to release. A guarded step installs the fixed Python toolchain
   (`ruff`/`pytest`/`build`/`twine`/`pip-audit`) before any Python target runs,
-  skipped cleanly on a workspace with no Python projects.
+  skipped cleanly on a workspace with no Python projects. On a `--ci=github`
+  workspace this same step also creates a **GitHub Release per project**, with
+  a changelog Nx generates from conventional commits — `nx release` pushes the
+  tag itself here (needs `GITHUB_TOKEN`, which GitHub Actions provides for
+  free under the workflow's own `contents: write` permission), so there's no
+  separate explicit `git push origin --tags` step on this provider. `--ci=azure`
+  and `--ci=both` keep today's behaviour (no GitHub Release, explicit tag
+  push) — GitHub Release creation only turns on when GitHub Actions is the
+  *only* configured provider, since that's the one case a `GITHUB_TOKEN` is
+  guaranteed to exist.
 
 **npm auth** is the base64 `PAT`, read the same way on both providers but from
 a different place: on Azure Pipelines, a **variable group**
@@ -400,8 +409,13 @@ than a surprise:
   inside the published `drop` artifact is the deploy input. Deploying it means
   Azure's Oryx build installing real dependencies (`npm install`/`pip install`)
   from the zipped manifest — no `node_modules`/venv is bundled.
-- Changelog files are off (unpushable under the tag-only model); the git tag
-  history is the changelog for now.
+- Changelog **files** are off everywhere (unpushable under the tag-only
+  model — `git.commit` stays `false`, so a written `CHANGELOG.md` would just
+  be discarded at the end of every CI run). On a `--ci=github` workspace (and
+  only that one — see below) each release still gets a real changelog: Nx
+  generates it from conventional commits and posts it straight to a GitHub
+  Release, with no file ever touched. `--ci=azure` and `--ci=both` fall back
+  to the git tag history as the changelog, same as before.
 - **No lock file for Python** — plain pip has none, matching the company
   standard this migration was for. A published wheel's `Requires-Dist` mirrors
   whatever specifier the `pyproject.toml` declares (e.g. `tomli>=2.0.0`)

package/dist/cli.js

@@ -1034,27 +1034,33 @@ function npmrcContent(registry, scope) {
   lines.push("");
   return lines.join("\n");
 }
-var RELEASE_CONFIG = {
-  projectsRelationship: "independent",
-  projects: ["packages/*", "python-packages/*"],
-  releaseTag: { pattern: "{projectName}@{version}" },
-  git: { commit: false, tag: true, push: false },
-  version: {
-    conventionalCommits: true,
-    fallbackCurrentVersionResolver: "disk",
-    // Build only what is being released. Without this, @nx/js:lib's generator
-    // defaults the pre-version command to building EVERY project, so a broken
-    // (or merely slow) app build would block releasing unrelated packages.
-    // Set here at `new` time it wins: the generator only fills this in when
-    // absent (it spreads the existing release.version over its default). Both
-    // globs are listed; `nx run-many` no-ops cleanly when one matches nothing.
-    preVersionCommand: "npx nx run-many -t build --projects=packages/*,python-packages/*"
-  },
-  changelog: { workspaceChangelog: false }
-};
+function releaseConfig(ci) {
+  const githubReleases = ci === "github";
+  return {
+    projectsRelationship: "independent",
+    projects: ["packages/*", "python-packages/*"],
+    releaseTag: { pattern: "{projectName}@{version}" },
+    git: { commit: false, tag: true, push: githubReleases },
+    version: {
+      conventionalCommits: true,
+      fallbackCurrentVersionResolver: "disk",
+      // Build only what is being released. Without this, @nx/js:lib's generator
+      // defaults the pre-version command to building EVERY project, so a broken
+      // (or merely slow) app build would block releasing unrelated packages.
+      // Set here at `new` time it wins: the generator only fills this in when
+      // absent (it spreads the existing release.version over its default). Both
+      // globs are listed; `nx run-many` no-ops cleanly when one matches nothing.
+      preVersionCommand: "npx nx run-many -t build --projects=packages/*,python-packages/*"
+    },
+    changelog: githubReleases ? {
+      workspaceChangelog: false,
+      projectChangelogs: { createRelease: "github", file: false }
+    } : { workspaceChangelog: false }
+  };
+}
 var SYNC_CONFIG = { applyChanges: true };
-function withReleaseConfig(nxJson) {
-  return { ...nxJson, defaultBase: "main", release: RELEASE_CONFIG };
+function withReleaseConfig(nxJson, ci) {
+  return { ...nxJson, defaultBase: "main", release: releaseConfig(ci) };
 }
 var COMMITLINT_CONFIG = `export default { extends: ['@commitlint/config-conventional'] }
 `;
@@ -1363,12 +1369,13 @@ steps:
     condition: ${onMain}
 `;
 }
-function githubActionsYaml(agent, pythonPublishUrl2, registryKind = "azure-artifacts") {
+function githubActionsYaml(agent, pythonPublishUrl2, registryKind = "azure-artifacts", ci = "github") {
   const onMain = `github.event_name != 'pull_request' && github.ref_name == 'main'`;
   const [npmAuthName, npmAuthValue] = npmAuthEnvVariable(
     registryKind,
     (name) => `\${{ secrets.${name} }}`
   );
+  const githubReleases = ci === "github";
   return `name: CI
 
 # Generated by MoNecromanCI. Deliberately thin: Nx builds, 'nx release'
@@ -1384,7 +1391,8 @@ on:
     branches: [main]
 
 permissions:
-  # Lets the release step push the version tag nx release creates back to main.
+  # Lets the release step push the version tag nx release creates back to main,
+  # and (github-only provider) create the GitHub Release itself.
   contents: write
 
 jobs:
@@ -1491,13 +1499,19 @@ jobs:
       # (python-packages/*) \u2014 conventional commits, tag-only push. Portable guard:
       # nx release errors on an empty scope, so skip cleanly when there is nothing
       # to release. When there are Python packages and an Azure feed, twine
-      # publish credentials are exported (raw PAT, decoded from the base64 secret).
+      # publish credentials are exported (raw PAT, decoded from the base64 secret).${githubReleases ? `
+      # This provider also creates a per-project GitHub Release (changelog
+      # generated from conventional commits since that project's last tag),
+      # which is why 'nx release' pushes the tag itself here \u2014 see
+      # releaseConfig's remarks for why that is safe on this Nx version and
+      # why every other provider combination keeps the explicit push step below.` : ""}
       - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2))}
-        name: Release \u2014 version, tag and publish (npm + Python)
+        name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python)
         if: \${{ ${onMain} }}
         env:
-          ${npmAuthName}: ${npmAuthValue}
-
+          ${npmAuthName}: ${npmAuthValue}${githubReleases ? `
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}` : ""}
+${githubReleases ? "" : `
       # nx release's own git push (release.git.push) is deliberately left off: it
       # only runs when a remote GitHub/GitLab Release is configured, which this
       # workflow never does, so it would never push the tag the step above just
@@ -1506,7 +1520,7 @@ jobs:
       - run: git push origin --tags
         name: Push release tags (nx release's own push never runs without a remote Release configured)
         if: \${{ ${onMain} }}
-`;
+`}`;
 }
 var DEPENDABOT_CONFIG = `# Generated by MoNecromanCI. Weekly dependency-update PRs so vulnerable or
 # stale dependencies surface as a reviewable PR instead of only a push-time
@@ -1543,7 +1557,10 @@ function applyOverlay(workspaceRoot, options) {
   };
   const sync = { ...nxJson.sync, ...SYNC_CONFIG };
   const mnci = { ...nxJson.mnci, ...mnciConfig(options) };
-  writeFileEnsured(nxJsonPath, toJson({ ...withReleaseConfig(nxJson), generators, sync, mnci }));
+  writeFileEnsured(
+    nxJsonPath,
+    toJson({ ...withReleaseConfig(nxJson, options.ci), generators, sync, mnci })
+  );
   const manifestPath = (0, import_node_path9.join)(workspaceRoot, "package.json");
   const manifest = readJson(manifestPath);
   const scripts = {
@@ -1580,7 +1597,7 @@ function applyOverlay(workspaceRoot, options) {
   if (options.ci === "github" || options.ci === "both") {
     writeFileEnsured(
       (0, import_node_path9.join)(workspaceRoot, ".github/workflows/ci.yml"),
-      githubActionsYaml(options.agent, publishUrl, options.registry.kind)
+      githubActionsYaml(options.agent, publishUrl, options.registry.kind, options.ci)
     );
     writeFileEnsured((0, import_node_path9.join)(workspaceRoot, ".github/dependabot.yml"), DEPENDABOT_CONFIG);
   }