Repository navigation
Conversation
| runs-on: macos-26-xlarge | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 |
There was a problem hiding this comment.
Nothing updates these pins once they're in — @v4 used to pick up patches on its own. A github-actions entry in .github/dependabot.yml would turn that back into reviewable PRs.
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | ||
| - name: Set up JDK 17 | ||
| uses: actions/setup-java@v3 | ||
| uses: actions/setup-java@e9fbacdec3bb3b6036605a3e6f7995d66773a8c6 # v3 |
There was a problem hiding this comment.
This SHA is the commit that deprecates setup-java v3, and v3 still declares runs.using: node16. Pinning it freezes CI on a major upstream has stopped maintaining; v6 is current.
|
|
||
| - name: Set up Ruby | ||
| uses: ruby/setup-ruby@v1 | ||
| uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0 |
There was a problem hiding this comment.
ruby/setup-ruby is the one action here upstream asks you not to pin — a pinned commit only carries the Ruby builds that existed at that commit, so a new macos-26-xlarge image can leave 3.0.1 unavailable and fail every PR. It's already behind v1.332.0.
| - name: Create Pull Request | ||
| id: create-pr | ||
| uses: peter-evans/create-pull-request@v5 | ||
| uses: peter-evans/create-pull-request@4e1beaa7521e8b457b572c090b25bd3db56bf1c5 # v5 |
There was a problem hiding this comment.
v5.0.3 is from March 2024 and still declares runs.using: node16; v8 is current. This workflow is workflow_dispatch-only, so when the node16 shim goes away nothing fails until someone starts a release.
| payload: | | ||
| attachments: | ||
| - color: good | ||
| text: ":tada: React Native plugin release pull request generated :tada:\n<!subteam^${{ secrets.SLACK_MOBILE_TEAM_ID }}> A new React Native plugin release pull request for (v${{ github.event.inputs.react_native_version }}) is ready! :rocket:\n${{ steps.create-pr.outputs.pull-request-url }}" |
There was a problem hiding this comment.
If SLACK_MOBILE_TEAM_ID is ever unset this expands to <!subteam^>, which Slack renders as inert text and pages no one — the same silent failure as the old @mobile-team. Masking also keeps the value out of the run log, so a repo variable would be easier to confirm is right. Same on the failure notification below.
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| VERSION: ${{ github.ref_name }} | ||
| run: | | ||
| awk -v v="## Version $VERSION" '$0 ~ v {flag=1; next} /## Version/ {flag=0} flag' CHANGELOG.md > release_notes.md |
There was a problem hiding this comment.
$0 ~ v is unanchored, so releasing 27.0.1 after 27.0.10 exists would match the 27.0.10 heading first and ship its notes. Pre-existing in the old awk, but this line is being rewritten anyway.
| VERSION: ${{ github.ref_name }} | ||
| run: | | ||
| awk -v v="## Version $VERSION" '$0 ~ v {flag=1; next} /## Version/ {flag=0} flag' CHANGELOG.md > release_notes.md | ||
| gh release create "$VERSION" --title "$VERSION" --notes-file release_notes.md --verify-tag |
There was a problem hiding this comment.
Nothing checks release_notes.md is non-empty, and check_version.sh only compares the tag to package.json — it never looks at CHANGELOG.md. A tag the trigger allows but the changelog has no heading for (27.1.0-beta.1) publishes a release with an empty body, after module may already have pushed to npm.
Ulrico972
left a comment
Ulrico972
left a comment
There was a problem hiding this comment.
Nice cleanup — verified all the pinned SHAs resolve to the tags they claim, and the release_notes.sh version-prefix fix looks solid.
One small note: check-version runs release_notes.sh once to validate the changelog section exists, then github-release runs it again to actually produce the notes. Intentional (fail fast before module publishes), just might be worth a one-line comment so it doesn't look like duplicated work later.
ci.yml,publish-docs.yml,release.ymlandprep-release.yml. The one exception isruby/setup-ruby, which stays on@v1because upstream recommends against pinning it (a pinned commit only carries the Ruby builds that existed at that commit).actions/setup-javav3 → v6.1.0 andpeter-evans/create-pull-requestv5 → v8.1.1 (both were still on node16)..github/dependabot.yml(new): weeklygithub-actionsupdates, grouped into a single PR, so the SHA pins keep getting reviewable updates.release.yml::set-output; the version comes fromgithub.ref_name.actions/create-releasewithgh release create --notes-file --verify-tag; thegithub-releasejob now haspermissions: contents: write.scripts/release_notes.sh, which matches the## Version Xheading exactly (so27.0.1can't match27.0.10) and fails if the section is missing or empty. It runs incheck-version, so a tag without a changelog entry stops the run beforemodulepublishes to npm.slatifywithslackapi/slack-github-actionv4.0.0 (SHA-pinned), keeping the same success/failure/cancelled logic and adding status colours.prep-release.ymlslatifysteps withslackapi/slack-github-actionv4.0.0.SLACK_MOBILE_TEAM_IDrepository variable (previously plain@mobile-team/@crowtext that notified no one).