Add per-PR preview releases for @coralogix/protofetch#196
Merged
Conversation
Creates a GitHub prerelease tagged v0.0.0-pr.<num>.<sha> on each PR with all platform binaries plus a packed @coralogix/protofetch wrapper as release assets. The existing getBinary.js URL pattern resolves against this tag so reviewers can run `npm install <release-tarball-url>` and get a working install. A sticky PR comment posts the install command. A companion cleanup workflow deletes the preview release and tag when the PR closes. The push.tags trigger now excludes -pr. tags so previews don't re-fire CI's real release pipeline.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a5b049e42a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
📦 Preview release availableA preview build of Installnpm install https://github.com/coralogix/protofetch/releases/download/v0.0.0-pr.196.48fa759/coralogix-protofetch-0.0.0-pr.196.48fa759.tgzDetails
This preview is automatically deleted when the PR is closed. |
actions/checkout v4 → v6 actions/setup-node v4 → v6 actions/download-artifact v4 → v8 actions/github-script v7 → v9
Switches both create-time and close-time cleanup from "list all releases and grep" to "query tags by prefix via git/matching-refs". The matching-refs API filters server-side, so cleanup scales independently of total repo release count and is no longer constrained by the gh release list --limit window. Adds a delete-before-create step in the preview-release job so each PR keeps at most one active preview release at any time, and a concurrency group keyed on the PR number so back-to-back commits cancel in-flight builds instead of racing on the same release tag.
2 tasks
cx-shahar-kazaz
added a commit
that referenced
this pull request
May 5, 2026
## Summary - Switch **both** npm packages (`cx-protofetch` and `@coralogix/protofetch`) from `NPM_TOKEN` secrets to OIDC trusted publishing - Add per-job `id-token: write` permission scoped to the npm jobs only (cargo and github jobs do not request OIDC) - Remove manual `.npmrc` token writes — npm CLI handles OIDC natively - Add explicit `contents: write` permission to the `github` job (required by `action-gh-release` v3) - Update actions: `actions/checkout` v4 → v6, `actions/download-artifact` v4 → v8, `softprops/action-gh-release` v1 → v3 ## Prerequisites before merging Both packages need a trusted publisher entry on npmjs.com pointing at this workflow. Workflow filename for both: `release.yml`, repo: `coralogix/protofetch`. - [ ] Configure trusted publisher on npmjs.com for **`cx-protofetch`** - [ ] Configure trusted publisher on npmjs.com for **`@coralogix/protofetch`** ## Notes - No `--dry-run` step on PRs — `release.yml` is `workflow_call`-only and PR validation already happens via the `test-npm-package` matrix job in `ci.yml`. PR-level preview installs are covered separately by [#196](#196). - `ci.yml` still has older action versions (checkout v3, download-artifact v4, etc.) — out of scope for this PR
smosca-coralogix
approved these changes
May 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
preview-releasejob that publishes a working preview of@coralogix/protofetchfor every PR, mirroring the pattern used infrontops-dev/domino.How it works:
packagematrix builds all platform binaries, a new job creates a GitHub prerelease taggedv0.0.0-pr.<num>.<sha>.protofetch_<target>.tar.gzfiles are uploaded as release assets — the URL pattern matches whatgetBinary.jsconstructs at install time, so the existing install logic works without any code changes.prepare-package.js --version 0.0.0-pr.<num>.<sha>, packed withnpm pack, and uploaded to the same release.npm install <tarball-url>command.One preview per PR: A
delete-before-createstep + concurrency group (preview-release-<pr-number>,cancel-in-progress: true) keeps each PR at exactly one active preview at any time, even with rapid pushes.Cleanup: A companion workflow (
preview-release-cleanup.yml) listens forpull_request: closedand deletes the preview release + tag. Both create-time and close-time cleanup query tags by prefix viagh api .../git/matching-refs/tags/v0.0.0-pr.<num>.— server-side filtering, so cleanup scales independently of total repo release count (nogh release list200-cap concern).Trigger gating: The push trigger's
tags:filter now excludes-pr.tags (!v*-pr.*) so creating the preview tag doesn't re-fire CI's real release pipeline.Tradeoffs / out of scope
head.repo.full_name == github.repository). Fork PRs from external contributors won't get a preview. If we need that later, we can switch to aworkflow_run-based design like domino's.@coralogix/protofetch, notcx-protofetch(per request —cx-protofetchis deprecated).release.yml(OIDC migration) — that's tracked in #195 and is independent.Reviewer install command
Reviewers see a comment like:
That
npm installtriggers the wrapper'spostinstall→getBinary.js→ fetches the platform binary from the same release. End-to-end, the preview install behaves exactly like a real release install.Verified end-to-end
Across 3 commits on this branch (
a5b049e→32f0136→266ddae):v0.0.0-pr.196.266ddaepresent after 3 commits —delete-before-createworkingcoralogix-protofetch-0.0.0-pr.196.266ddae.tgz(5.6 KB) + 5 platform tarballs (~16 MB total)11:48:04Z, updated12:21:45Z, one comment totalcurl→ 302 → 200,content-length: 5607matches the asset sizenpm install <preview-url>works in a clean directorypostinstallran, platform binary downloadednode_modules/.bin/protofetch --version→protofetch 0.1.15Observed transient failure
The middle commit's run (
32f0136) failed atgh release createwithHTTP 403: Resource not accessible by integration. The workflow YAML at that commit was identical (samepermissions:block) to the runs immediately before and after, both of which succeeded — almost certainly a transient GitHub token-issuance hiccup, not a code issue. Recovery was clean: the next commit'sdelete-before-createsaw no leftover release for32f0136(because it was never created) anda5b049e's release was cleaned up correctly. End state matched what we'd get if the failed run had never happened.This is a useful real-world data point that the design is retry-safe by construction —
delete-before-createis idempotent, so the next successful run self-heals from any partial-failure state.Cleanup-on-close test plan
Cleanup-on-close can only be verified once this PR is closed/merged, since it triggers on
pull_request: closed. After merge:v0.0.0-pr.196.*tags are deleted (currently 1 active tag)