ci: add CI, CodeQL and release automation - #18
Merged
Conversation
`prepare` runs `expo-module build` on every install, so `build/` was already being regenerated behind the tracked copy, which is a babel version behind what the source compiles to now. It also blocks release-it: every `yarn install` leaves the tree dirty, and a dirty tree aborts a release. npm still gets the directory. It's in `files`, and `prepare` rebuilds it on publish and on git installs.
`yarn lint` has been broken because eslint isn't in the lockfile at all, so it resolved to v10, which wants a flat config while the repo has `.eslintrc.js`. expo-module-scripts pulls eslint-config-universe 12, and that one is built against eslint 8. release-it and @release-it/conventional-changelog are for the release workflow.
The repo had no workflows at all, so nothing ran on a PR. CI covers pushes to master and every PR: lint, test, build, then `npm pack --dry-run` so an empty tarball fails the job now that `build/` is generated at install time instead of committed. CodeQL follows safe-jsx: PRs, pushes to master, and a weekly scan.
1.0.8 was bumped, tagged, released and published by hand, and CHANGELOG.md stopped at 1.0.6 under `@config-plugins/react-native-codepush`, a name this package has never been published under. release-it now derives all of it from the conventional commits since the last tag: the version bump, the CHANGELOG section, the annotated tag message and the GitHub release body. A `!` or a `BREAKING CHANGE:` footer bumps the major and shows up under the same `⚠ BREAKING CHANGES` heading in all three. The trigger is `workflow_dispatch` with an optional increment override, not a push to master. conventional-commits treats any commit as at least a patch, so pushing a README fix would otherwise ship a version. Backfilled 1.0.7 and 1.0.8 from git history and reshaped the older entries into the layout release-it writes, so the file reads as one thing.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
`yarn lint` didn't fail on eslint 8, it hung with no output, in CI and locally. eslint-config-universe peer-requires `prettier >=3` and it was never installed. eslint-plugin-prettier 5 loads prettier through a synckit worker, and with nothing to load the worker never answers, so eslint blocks forever inside the `prettier/prettier` rule. Nothing prints because the rule never returns. With prettier 3.9.6 installed, `yarn lint` finishes in 4 seconds.
universe sets most of its rules to `warn`, so `yarn lint` exits 0 no matter what eslint reports. src is clean as of the commit before this one, so `--max-warnings 0` starts from zero.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds three workflows and moves releases onto release-it. This repo had no workflows, and 1.0.8 was released by hand.
Workflows
CI, on every PR and every push to master: lint, test, build,npm pack --dry-run. The pack step is here because this PR stops trackingbuild/.CodeQL, on PRs, pushes to master and a weekly scan, following safe-jsx.Release, onworkflow_dispatchwith an optional increment override. release-it reads the conventional commits since the last tag and derives the version bump, the CHANGELOG section, the annotated tag message and the GitHub release body from them. A!or aBREAKING CHANGE:footer bumps the major and gets its own heading in the changelog, the tag and the release. I checked that path with a throwawayfeat!:commit under--dry-run.The trigger is manual because conventional-commits scores any commit as at least a patch, so pushing a README fix would ship a version.
NPM_TOKENis set on the repo, same as safe-jsx and magic-modal.Repo fixes
yarn lintwas failing on master. eslint isn't in the lockfile, so it resolved to v10, which wants a flat config while the repo has.eslintrc.js. Pinned to 8: expo-module-scripts brings eslint-config-universe 12, and its@typescript-eslint/utilsdeclareseslint@^7.0.0 || ^8.0.0.build/is no longer tracked.prepareregenerates it on every install, and a freshexpo-module buildalready rewrites 14 of the tracked files, so the committed copy was stale. A dirty tree afteryarn installalso aborts release-it. npm still gets the directory: it's infiles, andpreparerebuilds it on publish and on git installs.CHANGELOG.mdstopped at 1.0.6, under@config-plugins/react-native-codepush, a name this package has never been published under. 1.0.7 and 1.0.8 are backfilled from git history, and the older entries now match the layout release-it writes.Obsolescence
App Center's CodePush service shut down on 2025-03-31 and Microsoft archived react-native-code-push in May 2025. My read is keep the plugin:
CodePushServerURLat any CodePush-protocol server and prebuild writes the same native config it always did.109 downloads last month is small, and if the SDK's numbers start dropping I'd revisit. Deprecating today would strand anyone running their own server.
First release off this is 1.0.9, driven by
fix(deps): declare @babel/core(#16).Proof
CI green on this branch, all steps including the new pack check:
Locally, from an empty
node_modules: lint at zero warnings, 5 tests, a build, a 36-file tarball, and that tarball installed into a fresh project where the plugin registers all six mods.