Repository navigation
ci: release with release-please and deprecate every npm version - #472
Conversation
Merging the release-please PR tags the release, then publishes to npm with trusted publishing and provenance and runs npm deprecate on every version with a pointer to the migration guide, as Plyr did. Replaces the manual scripts/release and scripts/publish flow and its conventional-changelog dependencies.
|
Thank you for this pull request, and for the time you've put into Video-React. Video-React is now in security-only maintenance. Until January 2028, we'll merge priority security fixes and nothing else, so we're closing pull requests that don't fix a security issue, and this one won't be merged. Mux, which maintains Video-React, now works on Video.js 10 together with the teams behind Video.js, Vidstack, Plyr, and Media Chrome. If this change applies there, we'd love a pull request or issue in videojs/v10. To move a Video-React integration, follow the Migrate from Video-React guide. Migrating with a coding agent? Paste the prompt from the guide's AI Quickstart section into your agent. If this fixes a security vulnerability, comment here and we'll review it. For a vulnerability that isn't public yet, follow SECURITY.md instead. |
Addresses SonarCloud findings: pin the action to a commit SHA, and install an exact npm version without lifecycle scripts in the job that can publish.
|
Adds an automated release flow, modeled on Plyr's, that publishes Video-React security releases and deprecates the package on npm the way Plyr is deprecated.
How it works
Release PR: on each push to
master, release-please keeps achore(release): X.Y.ZPR up to date with the version bump andCHANGELOG.mdentries. Nothing is published until a maintainer merges it.Publish: merging that PR creates the tag and GitHub release. The
publishjob then runs lint, tests and the build, and publishes with npm trusted publishing and provenance, so no long-lived token is needed. The job runs in aProductionenvironment.Deprecate: it runs
npm deprecate "video-react@*"with:Trusted publishing can't run
npm deprecate, so this step uses anNPM_TOKENsecret. Only the deprecate step gets the token, so it can't replace trusted publishing for the publish itself. The step reruns on every release, because an earlier deprecation doesn't cover a new version. If the secret isn't set, the release still publishes and the job summary prints the command to run by hand. That matches what Plyr did: its workflow has no deprecate step, and 3.8.5 was deprecated about 8 minutes after it was published.Config
.github/release-please/holds the config, plus a manifest starting at 0.16.0.0.16.1, nov).bootstrap-shapoints at the 0.16.0 release commit. The0.16.0tag was never pushed, so release-please couldn't find it otherwise.bump-minor-pre-majormakes a breaking change bump the minor version instead of jumping to 1.0.0.Also in this PR
scripts/releaseandscripts/publish(which still referenced Travis), their npm scripts, and theconventional-changelogdev dependencies only they used.CONTRIBUTION.md: the Releasing section now covers the new flow and its setup.Setup before the first release (needs an npm owner)
video-react/video-react, workflowrelease.yml, environmentProduction. It must publish successfully within 2 days, so add it shortly before merging the first release PR.NPM_TOKENsecret (optional): a granular npm token with write access tovideo-reactthat can bypass 2FA. Without it, an owner runs the printednpm deprecatecommand after each release.Productionenvironment.Once this merges, the workflow opens the first release PR straight away. It doesn't publish anything until that PR is merged.
Verification
chore(release): 0.16.1, listing the fix: test, build, dep issues #459 fix plus the recent docs commits, and bumppackage.jsonandpackage-lock.json.npm ci,npm run lint,npm test(99/99),npm run build: all pass.npm pack --dry-run:scripts/is no longer in the tarball.