feat(ci): unify release workflows for npm Trusted Publishers OIDC

.github/workflows/release-please-beta.yml → .github/workflows/release.yml

@@ -1,14 +1,14 @@
-name: Beta Release
+name: Release
 
 on:
   push:
-    branches: [beta]
+    branches: [master, beta]
   workflow_dispatch:
 
 permissions: {}
 
 concurrency:
-  group: release-please-beta
+  group: release-${{ github.ref_name }}
   cancel-in-progress: false
 
 env:
@@ -36,9 +36,12 @@ jobs:
         run: bash .github/scripts/wait-for-workflow.sh ci.yml "$BRANCH" "$COMMIT_SHA"
 
   release-please:
-    name: Release Please (Beta)
+    name: Release Please
     needs: wait-for-ci
-    if: ${{ always() && github.ref_name == 'beta' && (github.event_name != 'push' || needs.wait-for-ci.result == 'success') }}
+    if: >-
+      always()
+      && (github.ref_name == 'master' || github.ref_name == 'beta')
+      && (github.event_name != 'push' || needs.wait-for-ci.result == 'success')
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -54,9 +57,9 @@ jobs:
         uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          target-branch: beta
-          config-file: release-please-config-beta.json
-          manifest-file: .release-please-manifest-beta.json
+          target-branch: ${{ github.ref_name }}
+          config-file: ${{ github.ref_name == 'beta' && 'release-please-config-beta.json' || 'release-please-config.json' }}
+          manifest-file: ${{ github.ref_name == 'beta' && '.release-please-manifest-beta.json' || '.release-please-manifest.json' }}
 
       - name: Update release title with date
         if: ${{ steps.release.outputs.release_created }}
@@ -74,20 +77,25 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REPO: ${{ github.repository }}
+          BRANCH: ${{ github.ref_name }}
         run: |
-          SHA=$(gh pr list --repo "$REPO" --head release-please--branches--beta --state open --json headRefOid --jq '.[0].headRefOid // empty')
+          SHA=$(gh pr list --repo "$REPO" --head "release-please--branches--${BRANCH}--components--solapi" --state open --json headRefOid --jq '.[0].headRefOid // empty')
           echo "sha=${SHA:-}" >> "$GITHUB_OUTPUT"
 
   test-release-pr:
-    name: Test (Beta Release PR)
+    name: Test (Release PR)
     needs: release-please
-    if: ${{ needs.release-please.result == 'success' && needs.release-please.outputs.release_created != 'true' && needs.release-please.outputs.pr_head_sha != '' }}
+    if: >-
+      needs.release-please.result == 'success'
+      && needs.release-please.outputs.release_created != 'true'
+      && needs.release-please.outputs.pr_head_sha != ''
     runs-on: ubuntu-latest
     permissions:
       contents: read
       statuses: write
     steps:
       - name: Set pending status
+        continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SHA: ${{ needs.release-please.outputs.pr_head_sha }}
@@ -147,15 +155,19 @@ jobs:
           || echo "::warning::Failed to report failure status on $SHA"
 
   lint-release-pr:
-    name: Lint (Beta Release PR)
+    name: Lint (Release PR)
     needs: release-please
-    if: ${{ needs.release-please.result == 'success' && needs.release-please.outputs.release_created != 'true' && needs.release-please.outputs.pr_head_sha != '' }}
+    if: >-
+      needs.release-please.result == 'success'
+      && needs.release-please.outputs.release_created != 'true'
+      && needs.release-please.outputs.pr_head_sha != ''
     runs-on: ubuntu-latest
     permissions:
       contents: read
       statuses: write
     steps:
       - name: Set pending status
+        continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SHA: ${{ needs.release-please.outputs.pr_head_sha }}
@@ -212,13 +224,13 @@ jobs:
           || echo "::warning::Failed to report failure status on $SHA"
 
   publish:
-    name: Publish to npm (Beta)
+    name: Publish to npm
     needs: release-please
-    if: ${{ needs.release-please.result == 'success' && needs.release-please.outputs.release_created == 'true' }}
+    if: >-
+      needs.release-please.result == 'success'
+      && needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
     environment: release
-    env:
-      HAS_NPM_TOKEN: ${{ secrets.NPM_TOKEN != '' }}
     permissions:
       contents: read
       id-token: write
@@ -246,15 +258,10 @@ jobs:
       - name: Build
         run: pnpm tsup
 
-      - name: Publish beta with trusted publishing
-        if: ${{ env.HAS_NPM_TOKEN != 'true' }}
-        run: npm publish --provenance --access public --tag beta
-
-      - name: Publish with provenance token fallback (beta)
-        if: ${{ env.HAS_NPM_TOKEN == 'true' }}
-        run: npm publish --provenance --access public --tag beta
+      - name: Publish
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TAG: ${{ github.ref_name == 'beta' && 'beta' || 'latest' }}
+        run: npm publish --tag "$NPM_TAG"
 
       - name: Report publish failure
         if: failure()