From 6aa9b3721a7c7d3779f8beccca15a48ea41d8b9c Mon Sep 17 00:00:00 2001 From: Anjey Tsibylskij <130153594+atldays@users.noreply.github.com> Date: Thu, 23 Jul 2026 14:11:12 +0300 Subject: [PATCH 1/4] chore(release): configure manual release workflow --- .github/workflows/release.yml | 20 +++++++++++++++----- README.md | 4 +++- nx.json | 2 +- 3 files changed, 19 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 692b6cb..27c9d24 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,25 +1,35 @@ name: Release on: - push: - branches: - - main + workflow_dispatch: concurrency: group: release-main cancel-in-progress: false permissions: - contents: write + contents: read id-token: write jobs: release: runs-on: ubuntu-latest steps: + - name: Create release App token + id: release-app-token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ vars.RELEASE_APP_ID }} + private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + owner: addon-stack + repositories: addon-pay - uses: actions/checkout@v6 with: fetch-depth: 0 + token: ${{ steps.release-app-token.outputs.token }} + - name: Verify release branch + run: | + test "$GITHUB_REF" = "refs/heads/main" - uses: pnpm/action-setup@v4 with: version: 11.1.2 @@ -37,5 +47,5 @@ jobs: - name: Version, release, and publish changed packages run: pnpm exec nx release --yes env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ steps.release-app-token.outputs.token }} NPM_CONFIG_PROVENANCE: "true" diff --git a/README.md b/README.md index f843cf5..59afd7c 100644 --- a/README.md +++ b/README.md @@ -88,7 +88,9 @@ Use Conventional Commits. The commit-msg hook and CI validate the format. Nx Rel ## Release model -After a Conventional Commit is merged into `main`, the release workflow validates the workspace, runs `nx release`, creates the version commit and tags, writes per-package GitHub Releases, and publishes only changed release packages. It uses npm Trusted Publishing, so releases after bootstrap require no npm token and receive npm provenance. +Conventional Commits merge into `main` through pull requests and accumulate until a maintainer starts the **Release** workflow manually from `main` in GitHub Actions. The workflow validates the workspace, runs `nx release`, creates the version commit and tags, writes per-package GitHub Releases, and publishes only changed release packages. It writes to GitHub through the repository-only `addon-stack-addon-pay-release` GitHub App, while npm Trusted Publishing supplies short-lived OIDC credentials for publishing with provenance. + +Always start the workflow from `main`; it rejects any other branch. Nx Release considers all unreleased Conventional Commits since the previous package tag, so several fixes can be published together in one patch release and a `feat` in the same package produces one minor release. ## First publication for a new package diff --git a/nx.json b/nx.json index fa3715d..3c010b9 100644 --- a/nx.json +++ b/nx.json @@ -10,7 +10,7 @@ "pattern": "{projectName}@{version}" }, "conventionalCommits": { - "useCommitScope": false + "useCommitScope": true }, "version": { "conventionalCommits": true, From f5ed76196755dc825a4615810178ced2f78ddd96 Mon Sep 17 00:00:00 2001 From: Anjey Tsibylskij <130153594+atldays@users.noreply.github.com> Date: Thu, 23 Jul 2026 14:11:19 +0300 Subject: [PATCH 2/4] feat(@addon-pay/sdk): clarify SDK responsibilities --- packages/@addon-pay/sdk/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/@addon-pay/sdk/README.md b/packages/@addon-pay/sdk/README.md index e1d05b2..279de50 100644 --- a/packages/@addon-pay/sdk/README.md +++ b/packages/@addon-pay/sdk/README.md @@ -1,3 +1,3 @@ # @addon-pay/sdk -Client runtime SDK for AddonPay applications. +Client runtime SDK for AddonPay applications. It exposes the application-facing data needed to evaluate entitlements, inspect plans, and retrieve paywall configuration. From d9557495092f710f88e60e6837a23da12331c68a Mon Sep 17 00:00:00 2001 From: Anjey Tsibylskij <130153594+atldays@users.noreply.github.com> Date: Thu, 23 Jul 2026 14:11:26 +0300 Subject: [PATCH 3/4] feat(@addon-pay/client): clarify client responsibilities --- packages/@addon-pay/client/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/@addon-pay/client/README.md b/packages/@addon-pay/client/README.md index cad4024..371d7c8 100644 --- a/packages/@addon-pay/client/README.md +++ b/packages/@addon-pay/client/README.md @@ -1,3 +1,3 @@ # @addon-pay/client -Control-plane API client for configuring AddonPay. +Control-plane API client for configuring AddonPay. It will automate the same plans, entitlements, and service configuration that developers manage in the AddonPay dashboard. From 5b1353b3d72cdf12dfaa5d001bed3b72d9cd7551 Mon Sep 17 00:00:00 2001 From: Anjey Tsibylskij <130153594+atldays@users.noreply.github.com> Date: Thu, 23 Jul 2026 14:21:16 +0300 Subject: [PATCH 4/4] chore(governance): define atldays as code owner --- .github/CODEOWNERS | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..b01b07d --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,2 @@ +# The primary maintainer must review all contributions from other identities. +* @atldays