chore(release): truthful versioning + changelog/git commit-back - #5
Merged
Merged
Conversation
- package.json: 0.1.0 -> 0.2.1 so the committed version matches the published npm latest instead of the frozen scaffold value. - Add @semantic-release/changelog + @semantic-release/git so future releases prepend CHANGELOG.md and commit the bump back to main, tagging that commit (checkout at any tag is now truthful). - Add a reconstructed CHANGELOG.md covering 0.1.0/0.2.0/0.2.1, noting that 0.2.0 was a trusted-publish smoke test that burned a minor. - docs/releasing.mdx: document the commit-back model and the branch protection bypass the release workflow now requires. Note: the release workflow needs a token allowed to bypass main's protected-branch rule for the git commit-back step (repo-admin action).
@semantic-release/git now commits the version + CHANGELOG back to the protected main branch. Consume the repo secret GH_TOKEN (admin PAT) on checkout and as GH_TOKEN/GITHUB_TOKEN for semantic-release, and set a release git identity — mirroring invertase/react-native-google-mobile-ads (semantic-release) and react-native-firebase (Lerna). Also set npm_config_workspaces_update=false so npm version does not choke on Yarn workspace: protocols during the bump. Requires adding GH_TOKEN as a repo secret (documented in releasing.mdx).
mikehardy
force-pushed
the
chore/release-hygiene
branch
from
September 24, 2026 20:22
7098a77 to
c02b173
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5 +/- ##
=========================================
Coverage 58.85% 58.85%
Complexity 15 15
=========================================
Files 22 22
Lines 1016 1016
Branches 230 230
=========================================
Hits 598 598
Misses 346 346
Partials 72 72
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Collaborator
Author
|
🎉 This PR is included in version 0.2.2 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses the release/version-drift smells (queue item F2): the committed
package.jsonsaid0.1.0while npm latest was0.2.1, there was no in-repoCHANGELOG.md, andv0.1.0had no GitHub Release.Root cause
The release setup deliberately omitted
@semantic-release/git, so@semantic-release/npmbumped the version only inside the published tarball and never committed it back. Versions are computed from git tags, so publishing worked, but the repo'spackage.jsonstayed frozen at the0.1.0scaffold value.0.2.0was a trusted-publish smoke test whose commit was typedfeat:, which burned a real minor — and that is the version RNFB/RNGMA happened to pin.What this changes (going forward)
@semantic-release/changelog+@semantic-release/gitadded torelease.config.js. Future releases prependCHANGELOG.mdand commit the bumpedpackage.json+ changelog back tomain, tagging that commit — so a checkout at anyv*tag is truthful.[skip ci].What this changes (retro)
package.json0.1.0->0.2.1to match the published npm latest. (Chose the truthful current version over0.0.0-development; from the next release on, the git plugin keeps it accurate automatically.)CHANGELOG.mdreconstructed from git history + existing GitHub Releases, covering0.1.0/0.2.0/0.2.1, with a note that0.2.0was a publishing smoke test.v0.1.0GitHub Release retroactively (out of band;v0.2.1remains "Latest").docs/releasing.mdxdocuments the commit-back model.@semantic-release/gitpushes to protectedmain. The defaultGITHUB_TOKENcannot bypass required PRs, so the release workflow needs a token allowed to bypass branch protection (a GitHub App / fine-grained PAT, or adding the release bot to "Allow specified actors to bypass required pull requests" on themainruleset). Until that is set, the git step of a real release would fail.Not done here (deliberate — needs a decision)
The queue mentioned retconning tags onto synthesized bump commits via a full history rewrite. The existing tags already point at the correct published SHAs (
v0.2.1->52b6c18= npm'sgitHead). A full rewrite would re-point every SHA (dangling the npmgitHeadreferences and orphaning open PRs) for a cosmetic gain. Recommend not rewriting history; adopt the truthful model from here forward instead. See PR discussion.Validation
release.config.jsloads; both new plugins resolve.package.jsonversion reads0.2.1.