ci: release automatically from conventional commits

.github/workflows/approval.yml

@@ -0,0 +1,45 @@
+name: Approval
+
+# Logdash team members merge their own pull requests on green checks.
+# Pull requests from anyone else need a team member to approve their latest commit; outside collaborators cannot approve each other's.
+# GitHub judges a required check by its newest run, so every run reads the reviews as they stand and never skips.
+# ponytail: anyone with write access can edit this file on their branch, so it stops accidental merges, not deliberate ones.
+on:
+    pull_request:
+    pull_request_review:
+        types: [submitted, dismissed]
+
+permissions:
+    pull-requests: read
+
+jobs:
+    approval:
+        name: team approval
+        runs-on: ubuntu-latest
+        steps:
+            - env:
+                  GH_TOKEN: ${{ github.token }}
+                  AUTHOR: ${{ github.event.pull_request.author_association }}
+                  PR: ${{ github.event.pull_request.number }}
+                  HEAD: ${{ github.event.pull_request.head.sha }}
+              run: |
+                  case "$AUTHOR" in OWNER|MEMBER) echo "Opened by a Logdash team member."; exit 0 ;; esac
+                  # Private organization members can show up as CONTRIBUTOR or NONE here, so a team review is a user review with write access from anyone but an outside collaborator.
+                  # shellcheck disable=SC2016 # $owner, $name and $pr are GraphQL variables, not shell ones.
+                  verdict=$(gh api graphql -F pr="$PR" -f owner="${GITHUB_REPOSITORY%/*}" -f name="${GITHUB_REPOSITORY#*/}" -f query='
+                    query($owner: String!, $name: String!, $pr: Int!) {
+                      repository(owner: $owner, name: $name) {
+                        pullRequest(number: $pr) {
+                          latestOpinionatedReviews(first: 100, writersOnly: true) {
+                            nodes { state authorAssociation author { __typename } commit { oid } }
+                          }
+                        }
+                      }
+                    }' | jq -r --arg head "$HEAD" '
+                    [.data.repository.pullRequest.latestOpinionatedReviews.nodes[] | select(.author.__typename == "User" and .authorAssociation != "COLLABORATOR")]
+                    | if any(.state == "CHANGES_REQUESTED") then "A Logdash team member requested changes"
+                      elif any(.state == "APPROVED" and .commit.oid == $head) then "approved"
+                      else "No Logdash team member has approved the latest commit yet" end')
+                  [ "$verdict" = approved ] && { echo "Approved by a Logdash team member."; exit 0; }
+                  echo "::error::$verdict. Outside contributions merge once a Logdash team member approves their latest commit."
+                  exit 1

.github/workflows/ci.yml

@@ -4,33 +4,80 @@ on:
     push:
         branches: [main]
     pull_request:
-        branches: [main]
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    # A release in progress must finish; a newer merge waits and releases after it.
+    cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+# Read-only unless a job asks for more: dependencies run in every job.
+permissions:
+    contents: read
 
 jobs:
     test:
         runs-on: ubuntu-latest
-
         strategy:
             matrix:
-                node-version: [18, 20, 22]
-
+                node-version: [18, 20, 22, 24]
         steps:
-            - uses: actions/checkout@v4
-
-            - name: Install pnpm
-              uses: pnpm/action-setup@v4
-
-            - name: Use Node.js ${{ matrix.node-version }}
-              uses: actions/setup-node@v4
+            - uses: actions/checkout@v7
+            - uses: pnpm/action-setup@v6
+            - uses: actions/setup-node@v7
               with:
                   node-version: ${{ matrix.node-version }}
-                  cache: 'pnpm'
-
-            - name: Install dependencies
-              run: pnpm install
+                  cache: pnpm
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm build
+            - run: pnpm lint
+            - run: pnpm test
+            # The release scripts run on Node 24, as in the version job.
+            - if: matrix.node-version == 24
+              run: node --test 'scripts/*.test.ts'
 
-            - name: Build
-              run: pnpm build
+    # The version the merged commits call for; empty when none of them is a feat, fix, perf, or breaking change.
+    version:
+        if: github.event_name == 'push'
+        runs-on: ubuntu-latest
+        outputs:
+            next: ${{ steps.next.outputs.version }}
+        steps:
+            - uses: actions/checkout@v7
+              with:
+                  fetch-depth: 0 # the tags and commits since the last release
+            - uses: actions/setup-node@v7
+              with:
+                  node-version: 24
+            # An assignment, unlike echo "version=$(...)", fails the step when the script fails.
+            - id: next
+              run: |
+                  version=$(node scripts/version.ts)
+                  echo "version=$version" >> "$GITHUB_OUTPUT"
 
-            - name: Test
-              run: pnpm test
+    # Publishes the merge to npm, then tags it with a GitHub Release.
+    release:
+        needs: [test, version]
+        if: needs.version.outputs.next != ''
+        runs-on: ubuntu-latest
+        permissions:
+            contents: write # the release and its tag
+            id-token: write # npm trusted publishing
+        env:
+            V: ${{ needs.version.outputs.next }}
+        steps:
+            - uses: actions/checkout@v7
+            - uses: pnpm/action-setup@v6
+            - uses: actions/setup-node@v7
+              with:
+                  node-version: 24 # its npm, 11.5.1 or newer, publishes with trusted publishing
+            # This job can publish, so no dependency runs its install scripts here.
+            - run: pnpm install --frozen-lockfile --ignore-scripts
+            - run: npm version "$V" --no-git-tag-version
+            - run: pnpm build
+            # Skipped when this version is already on npm, so rerunning a run whose release step failed just tags.
+            - run: '[ "$(npm view "@logdash/node@$V" version 2>/dev/null)" = "$V" ] || npm publish --access public'
+            # Last, since it creates the tag version.ts counts from: until it exists, later runs compute the same
+            # version, so a failed publish retries on the next merge and a failed release on a rerun.
+            - run: gh release create "v$V" --generate-notes --target "$GITHUB_SHA"
+              env:
+                  GH_TOKEN: ${{ github.token }}

.github/workflows/pr-title.yml

@@ -0,0 +1,20 @@
+name: PR title
+
+# Squash merges use the PR title as the commit subject, and scripts/version.ts reads it to pick the next version.
+on:
+    pull_request:
+        types: [opened, edited, reopened, synchronize]
+
+permissions: {}
+
+jobs:
+    conventional:
+        runs-on: ubuntu-latest
+        steps:
+            - env:
+                  TITLE: ${{ github.event.pull_request.title }}
+              run: |
+                  printf '%s' "$TITLE" | grep -qE '^(feat|fix|perf|refactor|docs|test|build|ci|chore|style|revert)(\(.+\))?!?: .+' || {
+                    echo "::error::PR title \"$TITLE\" is not a Conventional Commit, e.g. \"feat: add track for events\" or \"fix(queue): retry only failed metrics\". feat releases a minor, fix/perf a patch, ! a major; other types do not release."
+                    exit 1
+                  }

.prettierignore

@@ -10,3 +10,7 @@ vite.config.js*
 
 pnpm-lock.yaml
 pnpm-workspace.yaml
+
+# Copied verbatim from bestboyhq/tony
+/scripts/version.ts
+/scripts/version.test.ts

package.json

@@ -1,15 +1,13 @@
 {
 	"name": "@logdash/node",
-	"version": "1.0.2",
+	"version": "0.0.0",
 	"private": false,
 	"description": "How solo founders keep their SaaS apps healthy.",
 	"scripts": {
 		"build": "tsc -p tsconfig.lib.json",
+		"lint": "prettier --check .",
 		"test": "vitest run",
-		"test:watch": "vitest",
-		"release": "pnpm build && changeset publish",
-		"changeset": "changeset",
-		"version-packages": "changeset version"
+		"test:watch": "vitest"
 	},
 	"author": "Logdash Team <logdash.contact@gmail.com>",
 	"license": "MIT",
@@ -19,7 +17,6 @@
 	},
 	"homepage": "https://github.com/logdash-io/node-sdk",
 	"devDependencies": {
-		"@changesets/cli": "^2.29.8",
 		"@swc/core": "^1.15.6",
 		"@types/node": "^25.0.3",
 		"prettier": "^3.7.4",
@@ -37,6 +34,10 @@
 	"main": "./dist/index.js",
 	"module": "./dist/index.js",
 	"types": "./dist/index.d.ts",
+	"files": [
+		"dist",
+		"!dist/__tests__"
+	],
 	"keywords": [
 		"observability",
 		"monitoring",