ci: automate releases with Release Please

.github/workflows/release.yml

@@ -4,16 +4,26 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: "Exact prepared version, such as 10.0.1 or 9.8.3"
+        description: "patch, minor, major, or an exact stable version"
         required: true
+        default: "patch"
         type: string
+      announcement:
+        description: "Optional announcement, saved before the generated changelog"
+        required: false
+        type: string
+      release_tag:
+        description: "Existing release tag to resume publication without another version bump"
+        required: false
+        type: string
+
+permissions: {}
 
-permissions:
-  contents: write
-  # Both npm packages must trust margelo/react-native-nitro-sqlite's release.yml.
-  id-token: write
+env:
+  GH_REPO: ${{ github.repository }}
 
 concurrency:
+  # Serialize releases across branches so maintenance releases cannot race latest.
   group: release
   cancel-in-progress: false
 
@@ -26,112 +36,191 @@ jobs:
     with:
       full: true
 
-  release:
-    name: Publish packages and GitHub release
+  prepare:
+    name: Prepare release PR and lockfiles
     needs: preflight
-    runs-on: ubuntu-24.04
+    if: inputs.release_tag == ''
+    runs-on: macos-26
+    timeout-minutes: 40
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    outputs:
+      pr: ${{ steps.prepare.outputs.pr }}
+      version: ${{ steps.prepare.outputs.version }}
+    env:
+      # A separate token makes GitHub run the usual PR checks on automated commits.
+      GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.RELEASE_IT_GITHUB_TOKEN }}
+      RELEASE_INCREMENT: ${{ inputs.version }}
     steps:
+      - name: Check release credentials
+        run: |
+          if [ -z "$GH_TOKEN" ]; then
+            echo "Configure RELEASE_PLEASE_TOKEN with contents, pull requests, and issues write access." >&2
+            exit 1
+          fi
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ github.sha }}
-
-      - name: Validate release version
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          package-manager-cache: false
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.1
+      - name: Install release tooling
+        run: bun install --frozen-lockfile
+      - name: Test release automation
+        run: |
+          bun run test:release
+          bun run typecheck:release
+      - name: Create or refresh release PR
+        id: prepare
+        run: node scripts/prepare-release.ts
+      - name: Check out release PR
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ steps.prepare.outputs.branch }}
+          token: ${{ env.GH_TOKEN }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Synchronize workspace lockfile
+        run: |
+          bun install --lockfile-only --ignore-scripts
+          bun run sync:lockfile
+          bun run check:lockfile
+          bun install --frozen-lockfile
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.3.0
+          bundler-cache: true
+          working-directory: example
+      - name: Select Xcode
+        run: sudo xcode-select -s "/Applications/Xcode_26.5.app/Contents/Developer"
+      - name: Update iOS and macOS lockfiles
+        run: |
+          bun example pods
+          bun example pods:macos
+      - name: Commit lockfiles and optional announcement
+        run: node scripts/commit-release-lockfiles.ts
         env:
-          RELEASE_VERSION: ${{ inputs.version }}
+          RELEASE_BRANCH: ${{ steps.prepare.outputs.branch }}
+          RELEASE_ANNOUNCEMENT: ${{ inputs.announcement }}
+
+  merge:
+    name: Wait for checks, merge and tag release
+    needs: prepare
+    runs-on: ubuntu-24.04
+    timeout-minutes: 70
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    outputs:
+      tag: ${{ steps.release.outputs.tag }}
+    env:
+      GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.RELEASE_IT_GITHUB_TOKEN }}
+      RELEASE_PR: ${{ needs.prepare.outputs.pr }}
+      RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          package-manager-cache: false
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.1
+      - run: bun install --frozen-lockfile
+      - name: Merge when GitHub permits, then create a tagged draft
+        id: release
+        run: node scripts/merge-release.ts
+
+  publish:
+    name: Publish both packages from the release tag
+    needs: [preflight, merge]
+    if: ${{ always() && needs.preflight.result == 'success' && (needs.merge.result == 'success' || inputs.release_tag != '') }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      id-token: write
+    outputs:
+      tag: ${{ steps.validate.outputs.tag }}
+      latest: ${{ steps.validate.outputs.latest }}
+    env:
+      GH_TOKEN: ${{ github.token }}
+      RELEASE_TAG: ${{ needs.merge.outputs.tag || inputs.release_tag }}
+      NPM_CONFIG_PROVENANCE: "true"
+    steps:
+      - name: Validate tag input
         run: |
-          if [[ ! "$RELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "An exact stable release version is required." >&2
+          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "An existing stable release tag is required." >&2
             exit 1
           fi
-
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ env.RELEASE_TAG }}
+          fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-node@v7
         with:
           node-version: 24
           package-manager-cache: false
-
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.1
-
-      - name: Install npm dependencies (bun)
-        run: bun install
-
+      - run: bun install --frozen-lockfile
+      - name: Validate release and publication channel
+        id: validate
+        run: node scripts/validate-release.ts
       - name: Test release preflight
-        run: bun run test:release
-
-      - name: Check trusted publishing for both packages
         run: |
-          node --input-type=module <<'NODE'
-          const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL
-          const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN
-          if (!requestUrl || !requestToken) {
-            throw new Error('GitHub OIDC is unavailable to the release job')
-          }
-
-          const oidcUrl = new URL(requestUrl)
-          oidcUrl.searchParams.set('audience', 'npm:registry.npmjs.org')
-          for (const packageName of [
-            'react-native-nitro-sqlite',
-            'react-native-nitro-sqlite-vec',
-          ]) {
-            const oidcResponse = await fetch(oidcUrl, {
-              headers: { Authorization: `Bearer ${requestToken}` },
-            })
-            if (!oidcResponse.ok) {
-              throw new Error(`GitHub OIDC request failed: ${oidcResponse.status}`)
-            }
-            const { value: idToken } = await oidcResponse.json()
-            if (!idToken) {
-              throw new Error('GitHub OIDC response did not contain a token')
-            }
-
-            const exchangeUrl = new URL(
-              `/-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(packageName)}`,
-              'https://registry.npmjs.org',
-            )
-            const response = await fetch(exchangeUrl, {
-              method: 'POST',
-              headers: { Authorization: `Bearer ${idToken}` },
-            })
-            if (!response.ok) {
-              throw new Error(`${packageName}: npm OIDC exchange failed (${response.status})`)
-            }
-            const { token } = await response.json()
-            if (!token) {
-              throw new Error(`${packageName}: npm OIDC exchange returned no token`)
-            }
-            console.log(`${packageName}: npm trusted publishing is available`)
-          }
-          NODE
-
-      - name: Generate release notes
-        run: node scripts/generate-release-notes.ts "$RELEASE_VERSION" "$RUNNER_TEMP/release-notes.md"
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_VERSION: ${{ inputs.version }}
-
-      - name: Publish prepared release
-        run: ./scripts/release.sh --publish-prepared "$RELEASE_VERSION"
+          bun run test:release
+          bun run typecheck:release
+      - name: Assemble announcement, changelog and contributors
+        run: node scripts/generate-release-notes.ts "${RELEASE_TAG#v}" "$RUNNER_TEMP/release-notes.md"
+      - name: Publish packages with trusted publishing
+        # Both packages keep their existing trusted publisher for release.yml.
+        run: node scripts/publish-release.ts "${RELEASE_TAG#v}"
         env:
-          RELEASE_VERSION: ${{ inputs.version }}
           NPM_CONFIG_CACHE: ${{ runner.temp }}/npm-cache
-          NPM_CONFIG_PROVENANCE: "true"
-
-      - name: Create GitHub release
-        run: |
-          version="$RELEASE_VERSION"
-          latest=true
-          if [[ "${version%%.*}" == 9 ]]; then
-            latest=false
-          fi
-          gh release create "v${version}" --target "$(git rev-parse HEAD)" --title "NitroSQLite ${version}" --latest="$latest" --notes-file "$RUNNER_TEMP/release-notes.md"
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_VERSION: ${{ inputs.version }}
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-notes
+          path: ${{ runner.temp }}/release-notes.md
 
   build-android:
-    needs: release
+    needs: publish
+    permissions:
+      contents: write
     uses: ./.github/workflows/build-android-release.yml
     with:
-      tag: v${{ inputs.version }}
+      tag: ${{ needs.publish.outputs.tag }}
+
+  announce:
+    name: Publish GitHub release with notes and APK
+    needs: [publish, build-android]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: release-notes
+      - name: Publish draft release
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.RELEASE_IT_GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ needs.publish.outputs.tag }}
+          RELEASE_LATEST: ${{ needs.publish.outputs.latest }}
+        run: |
+          gh release edit "$RELEASE_TAG" --draft=false --title "NitroSQLite ${RELEASE_TAG#v}" --latest="$RELEASE_LATEST" --notes-file release-notes.md

.github/workflows/test-release.yml

@@ -0,0 +1,31 @@
+name: Test release automation
+
+on:
+  pull_request:
+    paths:
+      - "scripts/**"
+      - "*release*.json"
+      - "package.json"
+      - "bun.lock"
+      - ".github/workflows/release.yml"
+      - ".github/workflows/test-release.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          package-manager-cache: false
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.1
+      - run: bun install --frozen-lockfile
+      - run: bun run test:release
+      - run: bun run typecheck:release

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "10.1.0"
+}