ci: add release workflow using release-please by marcalexiei · Pull Request #867 · JoshuaKGoldberg/sentences-per-line

marcalexiei · 2026-01-03T21:17:07Z

PR Checklist

Addresses an existing open issue: fixes 🛠 Tooling: Set up automatic releases for monorepo #791
That issue was marked as status: accepting prs
Steps in CONTRIBUTING.md were taken

Overview

Add release.yml workflow using release-please to automate package release.
~~I'll add review comments to highlight key points, so we can discuss changes easily.~~

michaelfaith · 2026-01-04T00:22:07Z

Title should be ci: .... instead of chore: ...

michaelfaith

Love it! Just one minor change, and a suggestion to avoid possible race condition. In addition to those comments, I'd recommend tweaking the CI workflow triggers, similar to what's in michaelfaith/eslint-plugin-package-json#1497, so that adding a ci label to the release PR will trigger CI (removing the need for the token assignment in the release workflow)

JoshuaKGoldberg

This is lovely, I'm looking forward to trying it out!

I think everything @michaelfaith asked for is resolved, and I have nothing more to add. ✅

michaelfaith · 2026-01-04T13:40:14Z

There are a couple more things that I think will need to happen before this can be merged.

For one, If you want this PR to close #805, then it should include new CHANGELOG.md files for each package. release-please will update existing changelogs, but it won't create brand new files where none exist (I don't think). It also doesn't make as much sense to have a root level CHANGELOG anymore, and so I'd suggest removing the one from the root, and putting a copy of it in each package dir, as the starting place for release-please to add to.

The second thing is, somebody (probably @JoshuaKGoldberg?) will need to add a git / repo tag for each packages' latest version (minimally), in the form that release-please is going to look for. It uses those repo tags in order to understand what changes haven't yet been released. In the non-monorepo cases we've already migrated, it just happened to be the same format that release-it was already using (e.g. v0.3.0), so we didn't have to do anything there. But for the monorepo case, the tags have a "component" / package name prefix, to distinguish each release tag by which package it applies to. E.g. sentences-per-release-v0.3.0. The recent releases that have been done manually, also don't have any corresponding git tags. If the tags for at least the latest versions aren't added for each package, then release-please will think way more needs to be released, than actually does.

michaelfaith · 2026-01-04T13:44:20Z

Also, @JoshuaKGoldberg how do you feel about having separate-pull-requests enabled here? I would probably prefer a separate PR per package, if I were in your shoes.

// if true, create separate pull requests for each package instead of a
// single manifest release pull request
// absence defaults to false and one pull request will be raised
"separate-pull-requests": false,

michaelfaith

Sorry for piecemealing some of this out; I was just thinking more about the complete story and there are a couple more things (listed above) that would need to happen before this can merge.

JoshuaKGoldberg · 2026-01-16T13:52:29Z

Ok coming back to this: @marcalexiei @michaelfaith are we ready to merge, do you think?

michaelfaith · 2026-01-16T14:33:12Z

Ok coming back to this: @marcalexiei @michaelfaith are we ready to merge, do you think?

I believe there are some tactical decisions and repo changes (e.g. create initial tags) that we need from you before this can be merged: #867 (comment)

(Without at least deciding the tag format and creating those, release-please will create a big mega release pr for stuff that's already been released, though i guess that could just be closed if we wanted to merge this and do the rest as a followup...)

michaelfaith

Looks good to me! Thanks for sticking with it. I did make one minor / non-blocking suggestion. But otherwise, @JoshuaKGoldberg this should be ready for merge, unless you have additional feedback.

Once it does merge, I can keep an eye on what the workflow does, to ensure it's behaving as expected.

michaelfaith · 2026-01-19T20:36:56Z

+      # will publish all workspace packages with versions not yet present on the registry
+      # (so it only publishes packages whose versions were bumped and merged)
+      - name: Publish to npm
+        run: pnpm --filter "./packages/*" publish --no-git-checks


Nit: it might be cleaner to use --recursive/-r here (https://pnpm.io/cli/recursive)

Suggested change

run: pnpm --filter "./packages/*" publish --no-git-checks

run: pnpm -r publish --no-git-checks

I reverted this, I recalled why I used --filter: to avoid running this in the root package.json scope.

Interesting. Their docs reference publish specifically for this feature. I don't think it would attempt to publish the root, since it's private: true. But also this could be a follow-up change, and not critical to merge

JoshuaKGoldberg

Thanks for this, I really appreciate it! ❤️

JoshuaKGoldberg · 2026-01-21T23:44:31Z

@all-contributors please add @marcalexiei for infra.

🤖 Beep boop! This comment was added automatically by all-contributors-auto-action.
Not all contributions can be detected from Git & GitHub alone. Please comment any missing contribution types this bot missed.
...and of course, thank you for contributing! 💙

allcontributors · 2026-01-21T23:44:41Z

@JoshuaKGoldberg

I've put up a pull request to add @marcalexiei! 🎉

@marcalexiei

Adds @marcalexiei as a contributor for infra. This was requested by JoshuaKGoldberg [in this comment](#867 (comment)) --------- Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>

JoshuaKGoldberg · 2026-01-21T23:46:09Z

@allcontributors add michaelfaith as a contributor for infra

michaelfaith · 2026-01-21T23:46:12Z

https://github.com/JoshuaKGoldberg/sentences-per-line/actions/runs/21229941569/job/61086011634

Looks like we missed the pull-requests permission

allcontributors · 2026-01-21T23:46:23Z

@JoshuaKGoldberg

@michaelfaith already contributed before to infra

JoshuaKGoldberg · 2026-01-21T23:46:51Z

😩 I swear I'd applied it! Just re-did.

JoshuaKGoldberg · 2026-01-21T23:48:47Z

Hmm, looks like #920 has a bunch of the releases listed anyway. Let's see what happens...

michaelfaith · 2026-01-21T23:49:39Z

😩 I swear I'd applied it! Just re-did.

Oh no, not at the repo level, but in the workflow. This PR has

permissions:
      contents: read
      id-token: write # Required for OIDC

It should be

permissions:
      contents: write
      pull-requests: write
      id-token: write # Required for OIDC

JoshuaKGoldberg · 2026-01-21T23:50:51Z

And some more joy from https://github.com/JoshuaKGoldberg/sentences-per-line/actions/runs/21230070481/job/61086418201:

npm notice Security Notice: Classic tokens have been revoked. Granular tokens are now limited to 90 days and require 2FA by default. Update your CI/CD workflows to avoid disruption. Learn more https://gh.io/all-npm-classic-tokens-revoked
npm error code ENEEDAUTH
npm error need auth This command requires you to be logged in to https://registry.npmjs.org/
npm error need auth You need to authorize this machine using `npm adduser`
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2026-01-21T23_49_45_242Z-debug-0.log

michaelfaith · 2026-01-21T23:51:24Z

Oh no, not at the repo level, but in the workflow. This PR has

Oh, hmm, nm, that was a different job. The fact that the jobs aren't in execution order (but instead in alpha order) keeps throwing me off. Not sure what that error was for then.

michaelfaith · 2026-01-21T23:58:05Z

And some more joy from https://github.com/JoshuaKGoldberg/sentences-per-line/actions/runs/21230070481/job/61086418201:

npm notice Security Notice: Classic tokens have been revoked. Granular tokens are now limited to 90 days and require 2FA by default. Update your CI/CD workflows to avoid disruption. Learn more https://gh.io/all-npm-classic-tokens-revoked
npm error code ENEEDAUTH
npm error need auth This command requires you to be logged in to https://registry.npmjs.org/
npm error need auth You need to authorize this machine using `npm adduser`
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2026-01-21T23_49_45_242Z-debug-0.log

I think it might be because provenence wasn't removed from the package.json. I'll put that up. And just to confirm you did set the npm settings up for the sentences-per-line package?

michaelfaith · 2026-01-22T00:06:49Z

#922

marcalexiei commented Jan 3, 2026

View reviewed changes

marcalexiei marked this pull request as ready for review January 3, 2026 21:33

michaelfaith reviewed Jan 4, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

michaelfaith suggested changes Jan 4, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

Comment thread release-please-config.json

marcalexiei changed the title ~~chore: add release workflow using release-please~~ ci: add release workflow using release-please Jan 4, 2026

marcalexiei requested a review from michaelfaith January 4, 2026 02:07

JoshuaKGoldberg approved these changes Jan 4, 2026

View reviewed changes

michaelfaith suggested changes Jan 4, 2026

View reviewed changes

marcalexiei commented Jan 4, 2026

View reviewed changes

Comment thread .github/workflows/release.yml

Comment thread .github/workflows/release.yml

Comment thread .github/workflows/release.yml

marcalexiei added 6 commits January 19, 2026 17:48

chore: add release workflow using release-please

9f7f6f1

ci: port token changes from eslint-plugin-package-json

6d9339c

ci: add github-ref to concurrency so each commit has its own run

d2834c8

chore: format

0e53bf1

fix: remove --dry-run arg on release

272a02a

feat: set tag-separator to @

8f6f2c7

marcalexiei force-pushed the release-please branch from f94e18f to 8f6f2c7 Compare January 19, 2026 16:49

marcalexiei mentioned this pull request Jan 19, 2026

🛠 Tooling: Set up automatic releases for monorepo #791

Closed

3 tasks done

michaelfaith approved these changes Jan 19, 2026

View reviewed changes

marcalexiei force-pushed the release-please branch from 1fea626 to 8f6f2c7 Compare January 19, 2026 20:58

JoshuaKGoldberg approved these changes Jan 21, 2026

View reviewed changes

JoshuaKGoldberg merged commit fce218f into JoshuaKGoldberg:main Jan 21, 2026
19 of 25 checks passed

allcontributors Bot mentioned this pull request Jan 21, 2026

docs: add marcalexiei as a contributor for infra #918

Merged

marcalexiei deleted the release-please branch January 22, 2026 04:53

marcalexiei mentioned this pull request Jan 22, 2026

ci: remove provenance #922

Merged

1 of 3 tasks

	run: pnpm --filter "./packages/*" publish --no-git-checks
	run: pnpm -r publish --no-git-checks

Conversation

marcalexiei commented Jan 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Checklist

Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

michaelfaith commented Jan 4, 2026

Uh oh!

Uh oh!

michaelfaith left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

JoshuaKGoldberg left a comment

Choose a reason for hiding this comment

Uh oh!

michaelfaith commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

michaelfaith commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

michaelfaith left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JoshuaKGoldberg commented Jan 16, 2026

Uh oh!

michaelfaith commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

michaelfaith left a comment

Choose a reason for hiding this comment

Uh oh!

michaelfaith Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

marcalexiei Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

michaelfaith Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

JoshuaKGoldberg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

JoshuaKGoldberg commented Jan 21, 2026

Uh oh!

allcontributors Bot commented Jan 21, 2026

Uh oh!

JoshuaKGoldberg commented Jan 21, 2026

Uh oh!

michaelfaith commented Jan 21, 2026

Uh oh!

allcontributors Bot commented Jan 21, 2026

Uh oh!

JoshuaKGoldberg commented Jan 21, 2026

Uh oh!

JoshuaKGoldberg commented Jan 21, 2026

Uh oh!

michaelfaith commented Jan 21, 2026

Uh oh!

JoshuaKGoldberg commented Jan 21, 2026

Uh oh!

michaelfaith commented Jan 21, 2026

Uh oh!

michaelfaith commented Jan 21, 2026

Uh oh!

michaelfaith commented Jan 22, 2026

marcalexiei commented Jan 3, 2026 •

edited

Loading

michaelfaith commented Jan 4, 2026 •

edited

Loading

michaelfaith commented Jan 4, 2026 •

edited

Loading

michaelfaith commented Jan 16, 2026 •

edited

Loading