zx-bulk-release 3.0.2 → 3.0.4

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## [3.0.4](https://github.com/semrel-extra/zx-bulk-release/compare/v3.0.3...v3.0.4) (2026-04-11)
+
+### Fixes & improvements
+* docs: update gh action examples ([0511f95](https://github.com/semrel-extra/zx-bulk-release/commit/0511f95d62999c8f9a1b42562307a71f8b62c698))
+
+## [3.0.3](https://github.com/semrel-extra/zx-bulk-release/compare/v3.0.2...v3.0.3) (2026-04-11)
+
+### Fixes & improvements
+* fix: fallback ghApiUrl from config ([ac56cb0](https://github.com/semrel-extra/zx-bulk-release/commit/ac56cb014dea0bea9d3c352dd44900a0647e058f))
+
 ## [3.0.2](https://github.com/semrel-extra/zx-bulk-release/compare/v3.0.1...v3.0.2) (2026-04-11)
 
 ### Fixes & improvements

package/README.md

@@ -63,7 +63,6 @@ GH_TOKEN=ghtoken GH_USER=username NPM_TOKEN=npmtoken npx zx-bulk-release [opts]
 By default, zbr runs the full pipeline in a single process. For better security isolation, split build and delivery into separate CI jobs:
 
 ```yaml
-# Job 1: build (minimal privileges — source code access only)
 jobs:
   pack:
     runs-on: ubuntu-latest
@@ -72,20 +71,27 @@ jobs:
         with: { fetch-depth: 0 }
       - run: npx zx-bulk-release --pack
       - uses: actions/upload-artifact@v4
-        with: { name: parcels, path: parcels, retention-days: 1 }
+        with:
+          name: parcels
+          path: parcels
+          retention-days: 1
+          if-no-files-found: ignore
 
-# Job 2: deliver (only delivery credentials, no source code)
   deliver:
     needs: pack
     runs-on: ubuntu-latest
     steps:
       - uses: actions/download-artifact@v4
+        id: download
         with: { name: parcels, path: parcels }
-      - run: npx zx-bulk-release --deliver
+        continue-on-error: true
+      - if: steps.download.outcome == 'success'
+        run: npx zx-bulk-release --deliver
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      - uses: actions/upload-artifact@v4
+      - if: steps.download.outcome == 'success'
+        uses: actions/upload-artifact@v4
         with: { name: parcels, path: parcels, overwrite: true, retention-days: 1 }
 ```
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "zx-bulk-release",
   "alias": "bulk-release",
-  "version": "3.0.2",
+  "version": "3.0.4",
   "description": "zx-based alternative for multi-semantic-release",
   "type": "module",
   "exports": {

package/src/main/js/config.js

@@ -1,5 +1,6 @@
 import { cosmiconfig } from 'cosmiconfig'
 import { asArray, camelize, memoizeBy } from './util.js'
+import { GH_URL, resolveGhApiUrl } from './post/api/gh.js'
 
 const CONFIG_NAME = 'release'
 const CONFIG_FILES = [
@@ -58,11 +59,6 @@ export const normalizeMetaConfig = (meta) =>
         ? { type: meta } // 'commit' | 'asset' | 'tag'
         : { type: null }
 
-export const GH_URL = 'https://github.com'
-
-const resolveGhApiUrl = (ghUrl) =>
-  ghUrl === GH_URL ? 'https://api.github.com' : `${ghUrl.replace(/\/$/, '')}/api/v3`
-
 export const parseEnv = ({GH_USER, GH_USERNAME, GH_META, GH_URL: _GH_URL, GITHUB_URL, GITHUB_USER, GITHUB_USERNAME, GH_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NPM_REGISTRY, NPMRC, NPM_USERCONFIG, NPM_CONFIG_USERCONFIG, NPM_PROVENANCE, NPM_OIDC, ACTIONS_ID_TOKEN_REQUEST_URL, GIT_COMMITTER_NAME, GIT_COMMITTER_EMAIL} = process.env) => {
   const ghUrl = _GH_URL || GITHUB_URL || GH_URL
   return {

package/src/main/js/post/api/gh.js

@@ -3,6 +3,15 @@
 import {$, path, tempy, glob, fs, fetch} from 'zx-extra'
 import {asArray, attempt2} from '../../util.js'
 
+export const GH_URL     = 'https://github.com'
+export const GH_API_URL = 'https://api.github.com'
+export const GH_API_VERSION = '2022-11-28'
+export const GH_ACCEPT = 'application/vnd.github.v3+json'
+
+export const resolveGhApiUrl = (ghUrl) =>
+  ghUrl === GH_URL ? GH_API_URL : new URL('/api/v3', ghUrl).href
+
+
 export const getCommonPath = files => {
   const f0 = files[0]
   const common = files.length === 1
@@ -12,9 +21,6 @@ export const getCommonPath = files => {
   return p.endsWith('/') ? p : p.slice(0, p.lastIndexOf('/') + 1)
 }
 
-export const GH_API_VERSION = '2022-11-28'
-export const GH_ACCEPT = 'application/vnd.github.v3+json'
-
 export const ghFetch = (url, {ghToken, method = 'GET', headers, body} = {}) => fetch(url, {
   method,
   headers: {
@@ -75,7 +81,7 @@ export const ghPrepareAssets = async (assets, _cwd) => {
 }
 
 export const ghGetAsset = async ({repoName, tag, name, ghUrl}) => {
-  const url = `${ghUrl || 'https://github.com'}/${repoName}/releases/download/${tag.ref || tag}/${name}`
+  const url = `${ghUrl}/${repoName}/releases/download/${tag.ref || tag}/${name}`
   const res = await attempt2(() => fetch(url))
   if (!res.ok) {
     throw new Error(`gh asset fetch failed for '${name}': ${res.status} ${url}`)

package/src/main/js/post/courier/channels/npm.js

@@ -6,7 +6,7 @@ export const isNpmPublished = (pkg) =>
 
 export default {
   name:     'npm',
-  requires: ['token'],
+  requires: (manifest) => manifest.oidc ? [] : ['token'],
   when:     isNpmPublished,
   run:      (manifest, dir) => npmPublish({
     name: manifest.name,

package/src/main/js/post/courier/index.js

@@ -49,7 +49,8 @@ const openParcel = async (tarPath, env) => {
 
   if (!ch) return {warn: `unknown channel '${resolved.channel || '<none>'}'`}
 
-  const missing = (ch.requires || []).filter(f => !resolved[f])
+  const reqs = typeof ch.requires === 'function' ? ch.requires(resolved) : (ch.requires || [])
+  const missing = reqs.filter(f => !resolved[f])
   if (missing.length) return {warn: `missing credentials — ${missing.join(', ')}`, tarPath}
 
   return {ch, resolved, destDir, tarPath}

package/src/main/js/post/courier/parcel.js

@@ -24,8 +24,8 @@ const entry = {
     channel: 'gh-release',
     manifest: {
       channel: 'gh-release',
-      tag: pkg.tag, repoName: a.repoName, releaseNotes: a.releaseNotes,
-      token: '${{GH_TOKEN}}', apiUrl: '${{GH_API_URL}}',
+      tag: pkg.tag, repoHost: a.repoHost, repoName: a.repoName, releaseNotes: a.releaseNotes,
+      token: '${{GH_TOKEN}}', apiUrl: pkg.config.ghApiUrl,
       assets: pkg.config.ghAssets ? [...pkg.config.ghAssets] : undefined,
     },
     files: a.assetsDir ? [{name: 'assets', source: a.assetsDir}] : [],

package/src/main/js/post/release.js

@@ -31,7 +31,10 @@ export const run = async ({cwd = process.cwd(), env, flags = {}} = {}) => within
   if (flags.deliver) {
     const dir = typeof flags.deliver === 'string' ? flags.deliver : PARCELS_DIR
     const tars = await glob(path.join(dir, 'parcel.*.tar'))
-    if (!tars.length) throw new Error(`no tars found in ${dir}`)
+    if (!tars.length) {
+      log.info(`deliver: no parcels in ${dir}, nothing to do`)
+      return
+    }
     const _env = {...process.env, ...env}
     log.secret(_env.GH_TOKEN, _env.GITHUB_TOKEN, _env.NPM_TOKEN)
     log.info(`deliver: ${tars.length} tar(s) from ${dir}`)

package/src/test/js/utils/mock.js

@@ -86,6 +86,7 @@ export const makePkg = (overrides = {}) => ({
     gitCommitterEmail: 'bot@test.com',
     ghBasicAuth: 'x-access-token:ghp_test',
     ghToken: 'ghp_test',
+    ghApiUrl: 'https://api.github.com',
     npmPublish: true,
     npmFetch: false,
     changelog: 'changelog',