This is an automated email from the ASF dual-hosted git repository.
hsluoyz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/casbin-typeorm-adapter.git
The following commit(s) were added to refs/heads/master by this push:
new a846506 ci: replace semantic-release with tag-triggered manual release
a846506 is described below
commit a846506dd2db4a267ae19e7d576e0b702549a735
Author: Yang Luo <[email protected]>
AuthorDate: Tue Aug 4 14:40:21 2026 +0800
ci: replace semantic-release with tag-triggered manual release
---
.github/workflows/ci.yml | 21 ------
.github/workflows/release.yml | 161 ++++++++++++++++++++++++++++++++++++++++++
package.json | 1 -
3 files changed, 161 insertions(+), 22 deletions(-)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 80436ec..496abb1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -93,24 +93,3 @@ jobs:
- name: Run Unit test
run: yarn run test
-
- semantic-release:
- needs: [lint, test, coverage]
- runs-on: ubuntu-latest
- steps:
- - uses: actions/checkout@v4
-
- - name: Set up Node.js
- uses: actions/setup-node@v4
- with:
- node-version: ^20
-
- - name: Run semantic-release
- if: github.repository == 'apache/casbin-typeorm-adapter' &&
github.event_name == 'push'
- run: |
- yarn install
- yarn run prepublish
- yarn run release
- env:
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..a713a22
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,161 @@
+name: Release
+
+# Releases are triggered manually, by pushing a git tag. There is no automatic
+# release on merge/push to master, because Apache releases require a vote.
+#
+# v1.4.0-rc1 -> GitHub *pre-release* only (the artifact to vote on)
+# v1.4.0 -> GitHub release + publish to npm
+#
+# In both cases the release carries an Apache-style source tarball as an asset.
+# The release manager downloads it, signs it locally with their own GPG key and
+# uses it for the vote. Signing and uploading to dist.apache.org are
deliberately
+# NOT done here.
+
+on:
+ push:
+ tags:
+ - 'v*'
+
+permissions:
+ contents: write
+
+env:
+ # Apache source-release artifact naming:
apache-<project>-<version>[-incubating]-src.tar.gz
+ ARTIFACT_PREFIX: apache-casbin-typeorm-adapter
+ # Podlings must carry "incubating" in the artifact name. Set to '' after
graduation.
+ INCUBATING_SUFFIX: -incubating
+
+jobs:
+ release:
+ if: github.repository == 'apache/casbin-typeorm-adapter'
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+
+ - name: Parse tag
+ id: meta
+ run: |
+ set -euo pipefail
+ TAG="${GITHUB_REF_NAME}"
+ VERSION="${TAG#v}"
+
+ if [[ "$VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-[Rr][Cc]([0-9]+)$ ]];
then
+ BASE_VERSION="${BASH_REMATCH[1]}"
+ RC_NUMBER="${BASH_REMATCH[2]}"
+ IS_RC=true
+ elif [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+ BASE_VERSION="$VERSION"
+ RC_NUMBER=""
+ IS_RC=false
+ else
+ echo "::error::Tag '$TAG' is not a supported release tag. Use
vX.Y.Z or vX.Y.Z-rcN."
+ exit 1
+ fi
+
+ # The tarball is always named after the final version, never after
the RC.
+ # That way the exact bits (and filename) that were voted on are the
bits
+ # that get released - the RM does not have to rename or re-sign
anything.
+ ARTIFACT="${ARTIFACT_PREFIX}-${BASE_VERSION}${INCUBATING_SUFFIX}-src"
+
+ {
+ echo "tag=$TAG"
+ echo "base_version=$BASE_VERSION"
+ echo "rc_number=$RC_NUMBER"
+ echo "is_rc=$IS_RC"
+ echo "artifact=$ARTIFACT"
+ } >> "$GITHUB_OUTPUT"
+
+ - name: Build source release tarball
+ run: |
+ set -euo pipefail
+ ARTIFACT="${{ steps.meta.outputs.artifact }}"
+ mkdir -p dist-release
+ # git archive is deterministic for a given tag and excludes .git
entirely.
+ git archive --format=tar.gz \
+ --prefix="${ARTIFACT}/" \
+ -o "dist-release/${ARTIFACT}.tar.gz" \
+ "${{ steps.meta.outputs.tag }}"
+ cd dist-release
+ sha512sum "${ARTIFACT}.tar.gz" > "${ARTIFACT}.tar.gz.sha512"
+ sha512sum -c "${ARTIFACT}.tar.gz.sha512"
+ ls -l
+
+ - name: Write release notes
+ env:
+ ARTIFACT: ${{ steps.meta.outputs.artifact }}
+ BASE_VERSION: ${{ steps.meta.outputs.base_version }}
+ RC_NUMBER: ${{ steps.meta.outputs.rc_number }}
+ IS_RC: ${{ steps.meta.outputs.is_rc }}
+ run: |
+ set -euo pipefail
+ {
+ if [[ "$IS_RC" == "true" ]]; then
+ printf 'Release candidate %s for version `%s`.\n\n' "$RC_NUMBER"
"$BASE_VERSION"
+ printf 'This is **not** a released version. It is the source
artifact for the Apache release vote.\n\n'
+ else
+ printf 'Version `%s`.\n\n' "$BASE_VERSION"
+ fi
+ printf '| Asset | Description |\n| --- | --- |\n'
+ printf '| `%s.tar.gz` | Source release |\n' "$ARTIFACT"
+ printf '| `%s.tar.gz.sha512` | SHA-512 checksum |\n\n' "$ARTIFACT"
+ if [[ "$IS_RC" == "true" ]]; then
+ printf 'The release manager signs the tarball locally with their
own GPG key before starting the vote.\n'
+ else
+ printf 'The npm package is published as `typeorm-adapter@%s`.\n'
"$BASE_VERSION"
+ fi
+ } > release-notes.md
+ cat release-notes.md
+
+ - name: Create GitHub release
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ TAG: ${{ steps.meta.outputs.tag }}
+ BASE_VERSION: ${{ steps.meta.outputs.base_version }}
+ RC_NUMBER: ${{ steps.meta.outputs.rc_number }}
+ IS_RC: ${{ steps.meta.outputs.is_rc }}
+ run: |
+ set -euo pipefail
+ if [[ "$IS_RC" == "true" ]]; then
+ TITLE="v${BASE_VERSION}-rc${RC_NUMBER} (release candidate)"
+ # A candidate is never "latest" - it has not been voted on yet.
+ KIND=(--prerelease --latest=false)
+ else
+ TITLE="v${BASE_VERSION}"
+ KIND=(--latest)
+ fi
+
+ # Idempotent, so a re-run after a failure further down still works.
+ if gh release view "$TAG" >/dev/null 2>&1; then
+ echo "Release $TAG already exists, updating it."
+ gh release edit "$TAG" --title "$TITLE" --notes-file
release-notes.md "${KIND[@]}"
+ gh release upload "$TAG" dist-release/* --clobber
+ else
+ gh release create "$TAG" --title "$TITLE" --notes-file
release-notes.md "${KIND[@]}" dist-release/*
+ fi
+
+ - name: Set up Node.js
+ if: steps.meta.outputs.is_rc == 'false'
+ uses: actions/setup-node@v4
+ with:
+ node-version: ^20
+ registry-url: 'https://registry.npmjs.org'
+
+ - name: Publish to npm
+ if: steps.meta.outputs.is_rc == 'false'
+ env:
+ NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+ BASE_VERSION: ${{ steps.meta.outputs.base_version }}
+ run: |
+ set -euo pipefail
+ if npm view "typeorm-adapter@${BASE_VERSION}" version >/dev/null
2>&1; then
+ echo "typeorm-adapter@${BASE_VERSION} is already on npm, nothing
to publish."
+ exit 0
+ fi
+ yarn install --frozen-lockfile
+ # The tag is the source of truth for the version, not package.json.
+ npm version "$BASE_VERSION" --no-git-tag-version --allow-same-version
+ yarn run lint
+ yarn run build
+ npm publish --access public
diff --git a/package.json b/package.json
index 0792fec..3bb9ba8 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,6 @@
"lint": "eslint \"src/**/*.{ts,js,jsx}\"",
"fix": "eslint \"src/**/*.{ts,js,jsx}\" --fix",
"test": "jest --runInBand",
- "release": "npx -p semantic-release -p @semantic-release/git -p
@semantic-release/changelog semantic-release",
"prepare": "npm run build"
},
"devDependencies": {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
