dynamic versioning #12
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Reviewer's GuideConfigures the npm publish GitHub Action to derive the package version dynamically from the release tag and sets a development placeholder version in package.json, while simplifying the workflow to a single publish job with explicit setup, test, build, and publish steps. Flow diagram for dynamic versioning and npm publish jobflowchart LR
A["Release created with tag (e.g. v2.3.4)"] --> B["GitHub Actions workflow triggered (Publish Package)"]
B --> C["Step 1: Checkout repository (actions/checkout@v4)"]
C --> D["Step 2: Setup Node.js (Node 20, yarn cache, npm registry)"]
D --> E["Step 3: Install dependencies (yarn install --frozen-lockfile)"]
E --> F["Step 4: Extract version from tag"]
F --> G["Derive VERSION from GITHUB_REF, strip 'refs/tags/' and leading 'v'"]
G --> H["Expose version as output: steps.get_version.outputs.version"]
H --> I["Step 5: Update package.json version using npm version with derived VERSION"]
I --> J["package.json updated from placeholder '0.0.0-development' to release version"]
J --> K["Step 6: Run tests (yarn test)"]
K --> L{"Tests pass?"}
L -- "No" --> M["Job fails, package not built or published"]
L -- "Yes" --> N["Step 7: Build (yarn build)"]
N --> O["Step 8: Publish to npm (npm publish --provenance --access public) using NODE_AUTH_TOKEN"]
O --> P["Package with dynamic version is available on npm registry"]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
- Using
npm versionin a Yarn-based project will not updateyarn.lock, which can lead to version drift betweenpackage.jsonand the lockfile; consider usingyarn versionor directly editingpackage.json(e.g., withjq) so your lockfile stays in sync. - Instead of manually parsing
GITHUB_REFto derive the version, you can use the more robustgithub.ref_namecontext (${{ github.ref_name }}) to get the tag name without therefs/tags/prefix.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Using `npm version` in a Yarn-based project will not update `yarn.lock`, which can lead to version drift between `package.json` and the lockfile; consider using `yarn version` or directly editing `package.json` (e.g., with `jq`) so your lockfile stays in sync.
- Instead of manually parsing `GITHUB_REF` to derive the version, you can use the more robust `github.ref_name` context (`${{ github.ref_name }}`) to get the tag name without the `refs/tags/` prefix.
## Individual Comments
### Comment 1
<location> `.github/workflows/npm-publish.yml:26-33` </location>
<code_context>
+ - name: Install dependencies
+ run: yarn install --frozen-lockfile
+
+ - name: Extract version from tag
+ id: get_version
+ run: |
+ # Extract version from tag (remove 'v' prefix if present)
+ VERSION=${GITHUB_REF#refs/tags/}
+ VERSION=${VERSION#v}
+ echo "version=$VERSION" >> $GITHUB_OUTPUT
+ echo "Publishing version: $VERSION"
+
+ - name: Update package.json version
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Consider using github.ref_name and adding basic validation for the tag-derived version.
Parsing GITHUB_REF and stripping a leading 'v' is brittle and doesn’t protect against malformed tags. Using `${{ github.ref_name }}` removes the need to manually strip `refs/tags/`, and adding a simple pattern check (e.g., semver-like) would let the workflow fail fast if the tag format is unexpected, reducing the chance of publishing with an incorrect version.
```suggestion
- name: Extract version from tag
id: get_version
run: |
# Use the tag name directly and strip an optional leading 'v'
VERSION="${{ github.ref_name }}"
VERSION="${VERSION#v}"
# Basic validation: ensure VERSION looks like a SemVer (e.g. 1.2.3, 1.2.3-beta.1)
if ! echo "$VERSION" | grep -Eq '^[0-9]+(\.[0-9]+){2}(-[0-9A-Za-z.-]+)?$'; then
echo "Error: Tag '${{ github.ref_name }}' does not contain a valid semver version (got '$VERSION')." >&2
exit 1
fi
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
echo "Publishing version: $VERSION"
```
</issue_to_address>
### Comment 2
<location> `.github/workflows/npm-publish.yml:35-37` </location>
<code_context>
+ echo "version=$VERSION" >> $GITHUB_OUTPUT
+ echo "Publishing version: $VERSION"
+
+ - name: Update package.json version
+ run: |
+ npm version ${{ steps.get_version.outputs.version }} --no-git-tag-version --allow-same-version
+
+ - name: Run tests
</code_context>
<issue_to_address>
**issue (bug_risk):** Guard against an empty or invalid version output before calling `npm version`.
If `steps.get_version.outputs.version` is ever empty or malformed, `npm version` will default to incrementing patch, which could publish an unintended version. Please add a guard (e.g., fail the step when the version is missing or invalid) so the workflow stops instead of proceeding with a wrong version.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (60.19%) is below the target coverage (85.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #12 +/- ##
==========================================
+ Coverage 53.26% 60.19% +6.92%
==========================================
Files 51 51
Lines 2050 2050
Branches 512 524 +12
==========================================
+ Hits 1092 1234 +142
+ Misses 956 816 -140
+ Partials 2 0 -2
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR implements dynamic versioning for the npm package by extracting the version from Git release tags at publish time, rather than maintaining a static version in package.json.
- Sets package.json version to
0.0.0-developmentplaceholder - Extracts version from Git tag during release workflow
- Updates package.json dynamically before publishing
- Consolidates test and build steps into the publish workflow
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Changed version to 0.0.0-development placeholder for dynamic versioning |
| .github/workflows/npm-publish.yml | Restructured workflow to extract version from release tag, update package.json dynamically, and removed separate build job |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
mshriver
force-pushed
the
npm-publish-tweaks
branch
4 times, most recently
from
1220907 to
e5df33f
Compare
mshriver
force-pushed
the
npm-publish-tweaks
branch
from
e5df33f to
54d4da6
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
Update the npm publish workflow to derive the package version from the release tag and adjust package metadata accordingly.
Build:
CI:
Chores: