feat: let the release pick its own version

Preflight computes the release version instead of requiring a manual bump:
a patch bump past the highest of the latest v* tag and the npm-published
version, or cli/package.json's version when a PR raised it higher (minor/
major bumps). The version threads into publish-cli as a workflow input and
is applied with npm version before publishing. Basing the bump on npm as
well as tags means a rerun after a half-finished release always advances
past the orphaned npm version, so a tag can never point at code the
published tarball does not contain.

Author: 16francej

.github/workflows/publish-cli.yml

@@ -7,6 +7,10 @@ on:
         description: Commit SHA whose published images the package should pin
         required: false
         type: string
+      version:
+        description: Version to publish, overriding cli/package.json
+        required: false
+        type: string
     outputs:
       manifest:
         description: The image manifest the published package pins
@@ -16,6 +20,9 @@ on:
       images_ref:
         description: Commit SHA whose published images the package should pin
         required: false
+      version:
+        description: Version to publish, overriding cli/package.json
+        required: false
 
 permissions:
   contents: read
@@ -77,8 +84,14 @@ jobs:
           printf 'manifest=%s\n' "$(jq -c . cli/manifest.json)" >> "$GITHUB_OUTPUT"
       - name: Publish
         working-directory: cli
+        env:
+          VERSION: ${{ inputs.version }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           set -euo pipefail
+          if [ -n "$VERSION" ]; then
+            npm version "$VERSION" --no-git-tag-version --allow-same-version > /dev/null
+          fi
           version=$(jq -r .version package.json)
           if npm view "@yc-software/qm@$version" version > /dev/null 2>&1; then
             published=$(mktemp -d)
@@ -95,5 +108,3 @@ jobs:
           if [ "$version" = 0.1.5 ]; then
             npm deprecate @yc-software/qm@1.0.5 "Published with an incorrect version number; use 0.1.5."
           fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/release.yml

@@ -15,6 +15,7 @@ jobs:
       contents: read
     outputs:
       tag: ${{ steps.version.outputs.tag }}
+      version: ${{ steps.version.outputs.version }}
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
         with:
@@ -29,17 +30,27 @@ jobs:
             echo "releases are cut from main; this run is on $GITHUB_REF" >&2
             exit 1
           fi
-          version=$(jq -r .version cli/package.json)
-          case "$version" in
+          pkg=$(jq -r .version cli/package.json)
+          case "$pkg" in
             [0-9]*.[0-9]*.[0-9]*) ;;
-            *) echo "cli/package.json version must be semver, got $version" >&2; exit 1 ;;
+            *) echo "cli/package.json version must be semver, got $pkg" >&2; exit 1 ;;
           esac
+          tagged=$(gh api --paginate "repos/$GITHUB_REPOSITORY/git/matching-refs/tags/v" -q '.[].ref' \
+            | sed 's|^refs/tags/||' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sed 's/^v//' | sort -V | tail -1 || true)
+          published=$(npm view @yc-software/qm version 2>/dev/null || true)
+          base=$(printf '%s\n%s\n' "${tagged:-0.0.0}" "${published:-0.0.0}" | sort -V | tail -1)
+          if [ "$(printf '%s\n%s\n' "$base" "$pkg" | sort -V | tail -1)" = "$pkg" ] && [ "$pkg" != "$base" ]; then
+            version=$pkg
+          else
+            IFS=. read -r major minor patch <<< "$base"
+            version="$major.$minor.$((patch + 1))"
+          fi
           tag="v$version"
           if gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$tag" > /dev/null 2>&1; then
-            echo "$tag is already released; bump cli/package.json before releasing again" >&2
+            echo "$tag already exists; refusing to move it" >&2
             exit 1
           fi
-          printf 'tag=%s\n' "$tag" >> "$GITHUB_OUTPUT"
+          printf 'tag=%s\nversion=%s\n' "$tag" "$version" >> "$GITHUB_OUTPUT"
 
   images:
     name: Images
@@ -52,12 +63,16 @@ jobs:
 
   cli:
     name: CLI
-    needs: images
+    needs:
+      - preflight
+      - images
     permissions:
       contents: read
       id-token: write
     secrets: inherit
     uses: ./.github/workflows/publish-cli.yml
+    with:
+      version: ${{ needs.preflight.outputs.version }}
 
   release:
     name: Tag and publish the release

cli/README.md

@@ -22,9 +22,9 @@ This package is published to npm as `@yc-software/qm`, with npm provenance attes
 building workflow. A release is one dispatch of `.github/workflows/release.yml` from
 `main`: it signs and pushes the first-party images, publishes the package pinning their
 digests, and then tags `v<version>` and creates the GitHub release with the resolved
-digests attached. The version comes from `cli/package.json`, bumped in a PR before dispatching a release
-rather than by every pull request that touches the package; a tag that already exists
-stops the release rather than moving. The checked-in image manifest is a sentinel that
+digests attached. Each release picks its own version: a patch bump past the latest released version, or
+`cli/package.json`'s version when a PR raised it higher (for a minor or major bump); a
+tag that already exists stops the release rather than moving. The checked-in image manifest is a sentinel that
 a deployment overrides with real digests. The packed-artifact test exercises the consumer
 path locally.
 

test/release-workflows.test.ts

@@ -126,18 +126,24 @@ test("one dispatchable workflow drives the whole release, main-only and in order
     workflow,
     /^ {2}images:\n[\s\S]*?needs: preflight\n[\s\S]*?uses: \.\/\.github\/workflows\/release-package\.yml$/m,
   );
-  assert.match(workflow, /^ {2}cli:\n[\s\S]*?needs: images\n[\s\S]*?uses: \.\/\.github\/workflows\/publish-cli\.yml$/m);
+  assert.match(
+    workflow,
+    /^ {2}cli:\n[\s\S]*?needs:\n {6}- preflight\n {6}- images\n[\s\S]*?uses: \.\/\.github\/workflows\/publish-cli\.yml\n {4}with:\n {6}version: \$\{\{ needs\.preflight\.outputs\.version \}\}$/m,
+  );
   assert.match(workflow, /^ {2}release:\n[\s\S]*?needs:\n {6}- preflight\n {6}- cli$/m);
   assert.match(workflow, /concurrency:\n {2}group: release\n {2}cancel-in-progress: false/);
 });
 
-test("the release refuses a tag it already published and writes the tag last", () => {
+test("the release bumps its own version past everything already released", () => {
   const workflow = readFileSync(".github/workflows/release.yml", "utf8");
 
-  assert.match(workflow, /version=\$\(jq -r \.version cli\/package\.json\)/);
+  assert.match(workflow, /pkg=\$\(jq -r \.version cli\/package\.json\)/);
   assert.match(workflow, /cli\/package\.json version must be semver/);
+  assert.match(workflow, /matching-refs\/tags\/v/);
+  assert.match(workflow, /npm view @yc-software\/qm version/);
+  assert.match(workflow, /version="\$major\.\$minor\.\$\(\(patch \+ 1\)\)"/);
   assert.match(workflow, /tag="v\$version"/);
-  assert.match(workflow, /is already released; bump cli\/package\.json before releasing again/);
+  assert.match(workflow, /already exists; refusing to move it/);
   assert.ok(
     workflow.indexOf("already released") < workflow.indexOf("gh release create"),
     "the tag gate runs before anything is published",