feat: CLI installers and Package Publishing

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.2/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [["powersync", "@powersync/cli-core", "@powersync/cli-schemas", "@powersync/cli-plugin-docker"]],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.changeset/shaggy-parks-notice.md

@@ -0,0 +1,5 @@
+---
+'powersync': patch
+---
+
+[Internal] Configure trusted publishing and Github release flow.

.github/workflows/buildArtifacts.yml

@@ -0,0 +1,86 @@
+name: Build CLI Installer Artifacts Partial
+
+on:
+  workflow_call:
+    inputs:
+      retention-days:
+        description: 'Number of days to retain uploaded artifacts'
+        type: number
+        default: 7
+
+jobs:
+  package-installers:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            command: pack macos
+            artifact_name: macos-pkg
+            artifact_path: cli/dist/**/*.pkg
+          - os: windows-latest
+            command: pack win --targets win32-x64
+            artifact_name: windows-installer
+            artifact_path: cli/dist/**/*.exe
+          - os: ubuntu-latest
+            command: pack deb
+            artifact_name: linux-deb
+            artifact_path: cli/dist/**/*.deb
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'pnpm'
+      - name: Configure pnpm linker for Windows packaging
+        if: ${{ matrix.os == 'windows-latest' }}
+        shell: pwsh
+        run: Set-Content -Path cli/.npmrc -Value "node-linker=hoisted"
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build
+      - name: Install Windows packaging dependencies
+        if: ${{ matrix.os == 'windows-latest' }}
+        run: choco install nsis.portable 7zip grep --no-progress -y
+      - name: Verify Windows packaging dependencies
+        if: ${{ matrix.os == 'windows-latest' }}
+        shell: pwsh
+        run: |
+          where.exe makensis
+          where.exe 7z
+          where.exe grep
+      - name: Build installer
+        run: pnpm -C cli exec oclif ${{ matrix.command }}
+      - name: Upload installer artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.artifact_name }}
+          path: ${{ matrix.artifact_path }}
+          retention-days: ${{ inputs.retention-days }}
+
+  package-tarballs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build
+      - name: Install 7-zip for packaging
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y p7zip-full
+      - name: Build tarballs
+        run: pnpm -C cli exec oclif pack tarballs
+      - name: Upload tarball artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: tarballs
+          path: |
+            cli/dist/**/*.tar.gz
+            cli/dist/**/*.tar.xz
+          retention-days: ${{ inputs.retention-days }}

.github/workflows/onDispatchBuildArtifacts.yml

@@ -0,0 +1,15 @@
+name: Manually Build CLI Installers for Testing
+
+on:
+  workflow_dispatch:
+    inputs:
+      retention-days:
+        description: 'Number of days to retain uploaded artifacts'
+        type: number
+        default: 7
+
+jobs:
+  build-artifacts:
+    uses: ./.github/workflows/buildArtifacts.yml
+    with:
+      retention-days: ${{ inputs.retention-days || 7 }}

.github/workflows/onRelease.yml

@@ -1,4 +1,4 @@
-name: publish on release
+name: Add CLI Installers to GitHub Release
 
 env:
   # Increase heap to keep Nitro/Vite SSR builds (editor) from OOMing while treeshaking.
@@ -8,19 +8,32 @@ on:
   release:
     types: [released]
 
+permissions:
+  contents: write
+
 jobs:
-  publish:
+  build-artifacts:
+    if: startsWith(github.event.release.tag_name, 'powersync@')
+    uses: ./.github/workflows/buildArtifacts.yml
+    with:
+      retention-days: 1
+
+  publish-release-assets:
+    needs: [build-artifacts]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/download-artifact@v4
         with:
-          node-version-file: '.nvmrc'
-          cache: 'pnpm'
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm run build
-      # - name: Publish @powersync/cli to npm
-      #   run: pnpm publish -- --no-git-checks --access public
-      #   env:
-      #     NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          path: release-assets
+      - name: Upload assets to GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          tag="${{ github.event.release.tag_name }}"
+          files=$(find release-assets -type f \( -name "*.pkg" -o -name "*.exe" -o -name "*.deb" -o -name "*.tar.gz" -o -name "*.tar.xz" \))
+          if [ -z "$files" ]; then
+            echo "Error: No artifacts found to upload"
+            exit 1
+          fi
+          gh release upload "$tag" $files --clobber

.github/workflows/release.yml

@@ -0,0 +1,56 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch: # For dev publishing
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+permissions:
+  id-token: write # Required for OIDC / trusted publishing
+  contents: write # Required for changesets pushing commits
+  pull-requests: write # Required for changesets creating PRs
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v6
+      - name: Enable Corepack
+        run: corepack enable
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: '.nvmrc'
+          cache: pnpm
+      - name: Update npm
+        run: |
+          npm install -g npm@latest
+          npm --version
+      - name: Install dependencies
+        run: pnpm install
+
+      - name: Create Release Pull Request or Publish to npm
+        id: changesets
+        uses: changesets/action@v1
+        if: ${{ github.event_name == 'push' }}
+        with:
+          # Update the monorepo lockfile after versioning
+          version: pnpm changeset:version
+          # This expects you to have a script called release which does a build for your packages and calls changeset publish
+          publish: pnpm release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Dev publish
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          pnpm build:packages
+          pnpm changeset version --no-git-tag --snapshot dev
+          pnpm changeset publish --tag dev
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yml

@@ -1,4 +1,4 @@
-name: tests
+name: Unit Tests
 
 env:
   # Increase heap to keep Nitro/Vite SSR builds (editor) from OOMing while treeshaking.