name: Make Release
# RELEASE PROCESS
#
# === Automated activities ===
# 1. [Quality check] run unit tests and linting
# 2. [Release] publish package to npmjs.org using OIDC authentication with automatic provenance attestations
# 3. [Create tag] create a new git tag using released version, i.e. v1.13.1
#
# === Manual activities ===
# 1. Kick off `make-version` workflow to bump and review the version changes and changelog for each package
# 2. Merge the PR created by `make-version` workflow
# 3. Kick off this workflow to make the release
# 4. Update draft release notes with the latest changes and publish the release on GitHub
on:
workflow_dispatch: {}
permissions:
contents: read
concurrency:
group: on-release-publish
jobs:
run-unit-tests:
uses: ./.github/workflows/reusable-code-quality.yml
run-e2e-tests:
uses: ./.github/workflows/reusable-e2e.yml
# This job publishes the packages to npm.
# It uses OIDC authentication with automatic provenance attestations.
# We don't bump the version because we do that in the `make-version` workflow.
# It also sets the RELEASE_VERSION output to be used by the next job to create a git tag.
publish-npm:
needs: [run-e2e-tests, run-unit-tests]
# Needed for OIDC authentication with npm trusted publishing
permissions:
id-token: write
environment: Release
runs-on: ubuntu-latest
outputs:
RELEASE_VERSION: ${{ steps.set-release-version.outputs.RELEASE_VERSION }}
steps:
- name: Checkout code
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
ref: ${{ github.sha }}
- name: Setup Node.js
uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
with:
node-version: "24"
cache: "npm"
- name: Setup dependencies
uses: aws-powertools/actions/.github/actions/cached-node-modules@3b5b8e2e58b7af07994be982e83584a94e8c76c5
- name: Publish to npm
run: npm publish
- name: Set release version
id: set-release-version
run: |
VERSION=$(cat package.json | jq .version -r)
echo RELEASE_VERSION="$VERSION" >> "$GITHUB_OUTPUT"
# This job creates a new git tag using the released version (v1.18.1)
create_tag:
needs: [publish-npm]
permissions:
contents: write
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
ref: ${{ github.sha }}
- name: Git client setup
run: |
git config --global user.name 'aws-powertools-bot'
git config --global user.email '151832416+aws-powertools-bot@users.noreply.github.com'
git config remote.origin.url >&-
- name: Create git tag
run : |
git tag -a v${{ needs.publish-npm.outputs.RELEASE_VERSION }} -m "Release v${{ needs.publish-npm.outputs.RELEASE_VERSION }}"
git push origin v${{ needs.publish-npm.outputs.RELEASE_VERSION }}