chore: migrate from Release Please to semantic-release #51

gnapse · 2025-08-19T21:47:31Z

Resolves Use of non-approved third-party GitHub Actions #46
Resolves Release-Please v4 publish workflow not triggering automatically - requires manual re-tagging #35

Summary

Migrates from Release Please to semantic-release for automated releases
Removes the non-approved third-party action amannn/action-semantic-pull-request (fixes Use of non-approved third-party GitHub Actions #46)
Implements PR title validation using official GitHub Actions and commitlint

Changes

✅ Removed all Release Please configuration files and workflows
✅ Removed amannn/action-semantic-pull-request workflow
✅ Added semantic-release with conventionalcommits preset
✅ Added commitlint for PR title validation (uses only official GitHub Actions)
✅ Configured release workflow to trigger after CI validation passes
✅ Followed configuration patterns from the typist repository

Benefits

Faster releases: Automatic release on every merge to main (no PR review needed)
Tier 1 compliance: Uses only official GitHub Actions for PR validation
Proven approach: Follows the same pattern used in typist repository
Better automation: Releases happen immediately after CI passes

Test Plan

PR title validation workflow runs successfully
CI workflow completes successfully
After merge, semantic-release workflow triggers and creates a release
NPM package is published correctly

Migration Notes

After merging this PR:

Ensure the NPM_TOKEN secret is properly configured in the repository
Future PRs must use conventional commit format in their titles
Releases will happen automatically - no manual intervention needed

- Remove Release Please configuration and workflows - Remove amannn/action-semantic-pull-request (addresses issue #46) - Add semantic-release with conventional commits preset - Add commitlint for PR title validation using official GitHub Actions - Configure release workflow to trigger after CI validation - Match configuration patterns from typist repository BREAKING CHANGE: Release process now uses semantic-release instead of Release Please. Releases will be triggered automatically on merge to main after CI passes.

rfgamaral · 2025-08-21T16:31:12Z

.github/workflows/release.yml

+        run: npm run build
+
+      - name: Release
+        id: semantic-release


We can remove this, it's not being used.

Suggested change

id: semantic-release

rfgamaral · 2025-08-21T16:33:03Z

.github/workflows/release.yml

+      - name: Release
+        id: semantic-release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


In Typist we are using secrets.GH_REPO_TOKEN, which comes from organization secrets. I don't see that one in this repo's secrets. Not sure if I'm missing permissions, or it's just not there for some reason. But I would suggest use the same token to avoid issues.

I would also suggest we add the following env vars:

GIT_AUTHOR_EMAIL: [email protected] GIT_AUTHOR_NAME: Doist Bot GIT_COMMITTER_EMAIL: [email protected] GIT_COMMITTER_NAME: Doist Bot

rfgamaral · 2025-08-21T16:34:29Z

.github/workflows/release.yml

+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  packages: write
+  id-token: write


Just so it's clear what these are for.

Suggested change

permissions:

contents: write

issues: write

pull-requests: write

packages: write

id-token: write

permissions:

# Enable the use of OIDC for npm provenance

id-token: write

# Enable the use of GitHub Packages registry

packages: write

# Enable `semantic-release` to publish a GitHub release and post comments on issues/PRs

contents: write

issues: write

pull-requests: write

rfgamaral · 2025-08-21T16:35:22Z

.github/workflows/release.yml

+  packages: write
+  id-token: write
+
+jobs:


It's important we add this for the reasons mentioned in the comment (although we are not publishing this go GH Packages, I still think it's important to prevent a release in progress from being cancelled):

Suggested change

jobs:

# The release workflow involves many crucial steps that once triggered it shouldn't be cancelled

# until it's finished, otherwise we might end up in an inconsistent state (e.g., a new release

# published to npm but not GitHub Packages). To prevent this, concurrency is disabled with

# `cancel-in-progress: false`, and new workflow runs will be queued to be started only when the

# previous one has completely finished.

concurrency:

group: todoist-ai-package-release

cancel-in-progress: false

jobs:

rfgamaral · 2025-08-21T16:40:38Z

.github/workflows/pr-title-lint.yml

+name: PR Title Lint
+
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - synchronize
+
+jobs:
+  lint-pr-title:
+    name: Lint PR Title
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 'lts/*'
+
+      - name: Install commitlint
+        run: npm install @commitlint/cli @commitlint/config-conventional
+
+      - name: Lint PR title
+        run: echo "${{ github.event.pull_request.title }}" | npx commitlint


This is mentioned in the PR description:

Removes the non-approved third-party action amannn/action-semantic-pull-request

However, the version that Typist is using has been validated and approved, so I think we can safely use that one:

Suggested change

name: PR Title Lint

on:

pull_request:

types:

- opened

- edited

- synchronize

jobs:

lint-pr-title:

name: Lint PR Title

runs-on: ubuntu-latest

steps:

- name: Checkout

uses: actions/checkout@v4

- name: Setup Node.js

uses: actions/setup-node@v4

with:

node-version: 'lts/*'

- name: Install commitlint

run: npm install @commitlint/cli @commitlint/config-conventional

- name: Lint PR title

run: echo "${{ github.event.pull_request.title }}" | npx commitlint

name: Semantic Pull Request

on:

pull_request_target:

types:

- edited

- opened

- synchronize

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:

validate-title:

name: Validate Title

runs-on: ubuntu-latest

timeout-minutes: 5

steps:

- name: Validate pull request title

uses: amannn/action-semantic-pull-request@01d5fd8a8ebb9aafe902c40c53f0f4744f7381eb

This keeps the workflow consistent with the Typist one, which doesn't need to check out the repo and setup Node (slower).

rfgamaral · 2025-08-21T16:43:57Z

.releaserc.json

+        "@semantic-release/github",
+        [
+            "@semantic-release/exec",
+            {
+                "verifyConditionsCmd": "echo \"package-published=false\" >> $GITHUB_OUTPUT",
+                "successCmd": "echo \"package-published=true\" >> $GITHUB_OUTPUT"
+            }
+        ]


This is only required if we are publishing to npm and GH Packages in the same GH workflow, which we are not currently doing in this repo.

Suggested change

"@semantic-release/github",

[

"@semantic-release/exec",

{

"verifyConditionsCmd": "echo \"package-published=false\" >> $GITHUB_OUTPUT",

"successCmd": "echo \"package-published=true\" >> $GITHUB_OUTPUT"

}

]

"@semantic-release/github"

rfgamaral · 2025-08-21T16:46:49Z

.github/workflows/release.yml

+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}


Like I mentioned below, we are using the secrets.GH_REPO_TOKEN for this token in Typist, and I have a feeling these tokens are the difference between a successful release and a failed one. I would look into using GH_REPO_TOKEN from the organization secrets in both these instances.

rfgamaral · 2025-08-21T16:48:06Z

commitlint.config.js

If we go with amannn/action-semantic-pull-request@01d5fd8a8ebb9aafe902c40c53f0f4744f7381eb as mentioned above, we can delete this file as it's no longer needed.

rfgamaral · 2025-08-21T16:52:10Z

package.json

+        "@commitlint/cli": "^19.8.1",
+        "@commitlint/config-conventional": "^19.8.1",


If we go with amannn/action-semantic-pull-request@01d5fd8a8ebb9aafe902c40c53f0f4744f7381eb as mentioned above, we don't need these dependencies.

We do need conventional-changelog-conventionalcommits, which is missing from this file but need in the .releaserc.json configuration.

rfgamaral · 2025-08-21T16:52:57Z

package.json

+        "@commitlint/cli": "^19.8.1",
+        "@commitlint/config-conventional": "^19.8.1",
+        "@semantic-release/changelog": "^6.0.3",
+        "@semantic-release/exec": "^7.1.0",


If my suggestion to remove @semantic-release/exec from .releaserc.json, we can also remove this.

gnapse requested a review from rfgamaral August 19, 2025 21:50

gnapse force-pushed the feat/migrate-to-semantic-release branch from 5a47b5f to 5242992 Compare August 19, 2025 21:50

gnapse changed the title ~~feat: migrate from Release Please to semantic-release~~ chore: migrate from Release Please to semantic-release Aug 19, 2025

gnapse self-assigned this Aug 19, 2025

gnapse added the Ask PR is shipped after review label Aug 19, 2025

rfgamaral reviewed Aug 21, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: migrate from Release Please to semantic-release #51

chore: migrate from Release Please to semantic-release #51

Uh oh!

gnapse commented Aug 19, 2025 •

edited

Loading

Uh oh!

rfgamaral Aug 21, 2025

Uh oh!

rfgamaral Aug 21, 2025

Uh oh!

rfgamaral Aug 21, 2025

Uh oh!

rfgamaral Aug 21, 2025

Uh oh!

rfgamaral Aug 21, 2025

Uh oh!

rfgamaral Aug 21, 2025

Uh oh!

rfgamaral Aug 21, 2025

Uh oh!

rfgamaral Aug 21, 2025

Uh oh!

rfgamaral Aug 21, 2025

Uh oh!

rfgamaral Aug 21, 2025

Uh oh!

rfgamaral Aug 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-jobs:
+# The release workflow involves many crucial steps that once triggered it shouldn't be cancelled
+# until it's finished, otherwise we might end up in an inconsistent state (e.g., a new release
+# published to npm but not GitHub Packages). To prevent this, concurrency is disabled with
+# `cancel-in-progress: false`, and new workflow runs will be queued to be started only when the
+# previous one has completely finished.
+concurrency:
+    group: todoist-ai-package-release
+    cancel-in-progress: false
+jobs:

		"@commitlint/cli": "^19.8.1",
		"@commitlint/config-conventional": "^19.8.1",

chore: migrate from Release Please to semantic-release #51

Are you sure you want to change the base?

chore: migrate from Release Please to semantic-release #51

Uh oh!

Conversation

gnapse commented Aug 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Benefits

Test Plan

Migration Notes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gnapse commented Aug 19, 2025 •

edited

Loading