ci: setup PR-driven release pipeline [backport to v3]

.github/workflows/prepare-publish.yml

@@ -0,0 +1,99 @@
+name: Prepare Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      target_branch:
+        description: Release target branch.
+        required: true
+        default: main
+        type: string
+      release:
+        description: Bumpp release type.
+        required: true
+        default: next
+        type: choice
+        options:
+          - next
+          - patch
+          - minor
+          - major
+          - prepatch
+          - preminor
+          - premajor
+      version:
+        description: Specify exact version instead of bumpp release type
+        required: false
+        type: string
+
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.target_branch }}-${{ inputs.version || inputs.release }}
+  cancel-in-progress: false
+
+permissions: {}
+
+jobs:
+  prepare:
+    if: github.repository == 'vitest-dev/vitest'
+    name: Prepare release PR
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # checkout target branch
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.target_branch }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+
+      - name: Set node version to 24
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          package-manager-cache: false
+
+      - name: Install
+        run: pnpm install --frozen-lockfile --prefer-offline
+        env:
+          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'
+
+      - name: Create branch and update version
+        env:
+          TARGET_BRANCH: ${{ inputs.target_branch }}
+          RELEASE_TYPE: ${{ inputs.release }}
+          RELEASE_VERSION: ${{ inputs.version }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          RELEASE_INPUT="${RELEASE_VERSION:-$RELEASE_TYPE}"
+          PREPARE_BRANCH="prepare-$TARGET_BRANCH-$RELEASE_INPUT-$RUN_ID"
+          git switch -c "$PREPARE_BRANCH"
+          # The numeric prefix comes from `gh api /users/vitest-release-bot%5Bbot%5D --jq .id`.
+          # This is just to make the avatar in the commit look pretty.
+          git config user.name "vitest-release-bot[bot]"
+          git config user.email "292707936+vitest-release-bot[bot]@users.noreply.github.com"
+          pnpm run release
+
+      - id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.RELEASE_GITHUB_APP_ID }}
+          private-key: ${{ secrets.RELEASE_GITHUB_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Open release PR
+        env:
+          TARGET_BRANCH: ${{ inputs.target_branch }}
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+        run: |
+          PREPARE_BRANCH="$(git branch --show-current)"
+          VERSION="$(jq -r .version package.json)"
+          git push -u "https://x-access-token:$GH_TOKEN@github.com/$GITHUB_REPOSITORY.git" HEAD
+          gh pr create \
+            --base "$TARGET_BRANCH" \
+            --head "$PREPARE_BRANCH" \
+            --title "chore: release v$VERSION" \
+            --body "Release PR generated by the Prepare Publish workflow."

.github/workflows/publish.yml

@@ -2,8 +2,9 @@ name: Publish Package
 
 on:
   push:
-    tags:
-      - 'v*'
+    branches:
+      - main
+      - 'v[0-9]*'
 
 permissions: {}
 
@@ -12,9 +13,40 @@ env:
   VITE_TEST_WATCHER_DEBUG: 'false'
 
 jobs:
-  publish:
-    # only run on main, don't trigger in forks
+  # Keep detection outside the Release environment. Environment approval is job-level,
+  # so the publish job is only created after a release commit is detected.
+  detect:
     if: github.repository == 'vitest-dev/vitest'
+    name: Detect release commit
+    runs-on: ubuntu-slim
+    outputs:
+      release: ${{ steps.detect.outputs.release }}
+      version: ${{ steps.detect.outputs.version }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Detect release
+        id: detect
+        run: |
+          SUBJECT="$(git log -1 --format=%s)"
+          VERSION="$(jq -r .version package.json)"
+          EXPECTED="chore: release v$VERSION"
+          # use prefix match since commit has PR number trailer.
+          if [[ "$SUBJECT" == "$EXPECTED"* ]]; then
+            echo "release=true" >> "$GITHUB_OUTPUT"
+            echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+            echo "Detected release v$VERSION"
+          else
+            echo "release=false" >> "$GITHUB_OUTPUT"
+            echo "No release commit found at HEAD"
+          fi
+
+  publish:
+    if: needs.detect.outputs.release == 'true'
+    needs: detect
     name: Publish Vitest
     runs-on: ubuntu-latest
     permissions:
@@ -27,8 +59,16 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+      - name: Check release tag
+        env:
+          VERSION: ${{ needs.detect.outputs.version }}
+        run: |
+          TAG="v$VERSION"
+
+          if git rev-parse --verify --quiet "refs/tags/$TAG"; then
+            echo "Tag $TAG already exists"
+            exit 1
+          fi
 
       - name: Set node version to 24
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -38,6 +78,9 @@ jobs:
           # disable cache to avoid cache poisoning
           package-manager-cache: false
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+
       - name: Install
         run: pnpm install --frozen-lockfile --prefer-offline
         env:
@@ -46,10 +89,47 @@ jobs:
       - name: Build
         run: pnpm build
 
-      - name: Publish to npm
-        run: npm i -g npm@^11.5.2 && pnpm run publish-ci "${GITHUB_REF_NAME}"
+      - name: Install pnpm for staged publishing
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+        with:
+          version: 11.6.0
+          # Do not read package.json's pnpm@10 packageManager field when installing pnpm 11.
+          package_json_file: .github/pnpm-publish-package.json
+
+      - name: Stage publish to npm (dry run)
+        env:
+          VERSION: ${{ needs.detect.outputs.version }}
+          PUBLISH_BRANCH: ${{ github.ref_name }}
+          PUBLISH_DRY_RUN: 'true'
+          # Keep pnpm 11 instead of switching to package.json's pnpm@10 during staged publishing.
+          PNPM_CONFIG_PM_ON_FAIL: ignore
+          # Avoid pnpm 11 rerunning install before pnpm run, which can fail on unapproved builds.
+          PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN: 'false'
+        run: pnpm run publish-ci "$VERSION"
+
+      - name: Stage publish to npm
+        env:
+          VERSION: ${{ needs.detect.outputs.version }}
+          PUBLISH_BRANCH: ${{ github.ref_name }}
+          PNPM_CONFIG_PM_ON_FAIL: ignore
+          PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN: 'false'
+        run: pnpm run publish-ci "$VERSION"
+
+      - name: Push release tag
+        env:
+          VERSION: ${{ needs.detect.outputs.version }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="v$VERSION"
+          git config user.name "vitest-release-bot"
+          git config user.email "actions@github.com"
+          git tag "$TAG" "$GITHUB_SHA"
+          git push "https://x-access-token:$GITHUB_TOKEN@github.com/$GITHUB_REPOSITORY.git" "$TAG"
 
       - name: Generate Changelog
-        run: npx changelogithub
         env:
+          VERSION: ${{ needs.detect.outputs.version }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="v$VERSION"
+          npx changelogithub --to "$TAG" --name "$TAG"

package.json

@@ -43,6 +43,7 @@
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^16.0.1",
     "@types/node": "^22.15.32",
+    "@types/semver": "catalog:",
     "@types/ws": "catalog:",
     "@vitest/browser": "workspace:*",
     "@vitest/coverage-istanbul": "workspace:*",
@@ -58,6 +59,7 @@
     "rollup": "^4.43.0",
     "rollup-plugin-dts": "^6.2.1",
     "rollup-plugin-license": "^3.6.0",
+    "semver": "catalog:",
     "tinyglobby": "catalog:",
     "tsx": "^4.20.3",
     "typescript": "^5.8.3",

pnpm-workspace.yaml

@@ -16,6 +16,7 @@ catalog:
   '@types/istanbul-lib-report': ^3.0.3
   '@types/istanbul-lib-source-maps': ^4.0.4
   '@types/istanbul-reports': ^3.0.4
+  '@types/semver': ^7.7.1
   '@types/test-exclude': ^6.0.2
   '@types/ws': ^8.18.1
   '@unocss/reset': ^66.2.1
@@ -35,6 +36,7 @@ catalog:
   magicast: ^0.3.5
   msw: ^2.10.2
   pathe: ^2.0.3
+  semver: ^7.8.3
   sirv: ^3.0.1
   std-env: ^3.9.0
   strip-literal: ^3.0.0