Skip to content

ci(release): resolve the next version without push credentials #243

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dborgards merged 1 commit into from
Sep 30, 2026
Merged

ci(release): resolve the next version without push credentials #243

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions eng/next-release-version.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,15 @@
// This is not a full `semantic-release --dry-run`. That loads the GitHub and git plugins,
// which check push permission and want a write token. The version is decided only by the
// commit analyser, so that is the only plugin invoked. No token, no pack, no push.
//
// One check is not a plugin's, though: before any plugin runs, semantic-release itself runs
// `git push --dry-run` against the repository URL, dry run or not, and aborts with
// EGITNOPERMISSION if that fails. The `verify` job deliberately has no credentials, so the URL
// given below is this checkout rather than GitHub: pushing HEAD to the branch it already is
// needs no network, no token, and changes nothing.

import { readFileSync } from 'node:fs';
import { fileURLToPath } from 'node:url';
import semanticRelease from 'semantic-release';

const config = JSON.parse(readFileSync(new URL('../.releaserc.json', import.meta.url), 'utf8'));
Expand All @@ -22,6 +29,7 @@ const result = await semanticRelease(
// GitHub Actions sets CI=true; without this the library demands a write token even though
// nothing here publishes. The analyser only needs the git history.
ci: false,
repositoryUrl: fileURLToPath(new URL('..', import.meta.url)),
branches: config.branches,
tagFormat: config.tagFormat,
plugins: versionPlugins,
Expand Down
Loading