Uh oh!
There was an error while loading. Please reload this page.
Pin changesets/action and migrate to v2 - #2451
Merged
Merged
Conversation
changesets/action@master is worse than unpinned. That repo's default branch is `main`; `master` was last touched in November 2021, while the action has since shipped through v2.1.1 this month. The ref wasn't drifting, it was frozen on a four-year-old build with nothing to signal that development had moved elsewhere. v2 renames every input this workflow used, so the pin can't be done alone: publish -> publish-script title -> pr-title version -> version-script commit -> commit-message Two further breaking changes needed handling. v2 no longer reads a token from the GITHUB_TOKEN environment variable; the `github-token` input defaults to the GitHub-provided token, which is what this used, so it is dropped. And v2 no longer writes an .npmrc from NPM_TOKEN — authentication moves to setup-node's registry-url plus NODE_AUTH_TOKEN. Without that, publishing would fail on credentials. v2 requires Changesets v3; this repo is on @changesets/cli 3.0.1. Also lifts the pinned Node version into an env var, matching ci.yml.
✅ Deploy Preview for cloudfour-patterns ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
changesets.ymlwas still trackingchangesets/action@master, the last floating action ref in this repo. It turned out to be a worse problem than "unpinned": that repository's default branch ismain, andmasterwas last committed to in November 2021 — while the action has shipped v2.0.0, v2.1.0 and v2.1.1 in the past two weeks. The ref wasn't drifting with upstream, it was frozen on a four-year-old build with nothing to signal that development had moved elsewhere. Renovate can see the entry but can't propose an upgrade from a branch ref, which is why it never surfaced.That means the pin can't be done on its own. v2 renames every input this workflow used, and changes how both tokens are supplied. Since this is the workflow that publishes to npm, the details are below — the failure modes here are quiet ones.
Found while auditing floating action refs across the org: of 137 non-archived repos, three had one. This and
lighthouse-paradewere two of them; the third belongs to another maintainer and was left alone.Screenshots
Testing
There's no way to exercise this without an actual release, so the useful review is reading rather than running. These are the things to check when it does run.
publish-script,version-script,pr-title,commit-message.Releaserun onmain. It should update the existing "Publish Next Version" pull request rather than opening a second one —pr-titleis unchanged, so it should match..npmrcfromNPM_TOKEN, so auth now comes fromsetup-node'sregistry-urlplusNODE_AUTH_TOKEN. A failure looks likeENEEDAUTHor a 401 from the registry, not a workflow syntax error.mainas usual. v2 pushes them via the GitHub API rather than the Git CLI by default, so they'll be signed by GitHub and attributed to the token owner — expect the commit author to look different from previous releases.Notes for the reviewer
Three breaking changes needed handling beyond the renames:
GITHUB_TOKENenv var is ignored in v2. Thegithub-tokeninput now has to be explicit — but it defaults to the GitHub-provided token, which is exactly what this was passing. So it's dropped rather than converted.NPM_TOKENenv var no longer configures npm. v2 removed its.npmrchandling and directs you tosetup-node'sregistry-urlwithNODE_AUTH_TOKEN. The repository secret is unchanged; only the variable name it binds to differs.permissionsis now required. v2's docs call forcontents: writeandpull-requests: write. Declaring them explicitly also drops every other permission the default token would carry.v2 requires Changesets v3. This repo is on
@changesets/cli3.0.1, so that's satisfied — worth confirming, since the v1 line is what pairs with Changesets v2.Also lifted the pinned Node version into an
envblock to match whatci.ymlin this repo already does. No behavior change.The equivalent change for
lighthouse-paradeis in cloudfour/lighthouse-parade#389.