[release] use changesets/action for canary release (vercel#79038)

This PR uses `changesets/action` to handle the canary release. Since the
action creates a Version Packages PR by default, I added a GH Action
that checks if the PR is released from the correct release workflow. It
triple-verifies via the user login (`vercel-release-bot`), PR title
(`Version Packages (canary)`), and a label (`created-by: CI`) to ensure
the opened PR is not trying to spoof.

After the validation, the PR bypasses required checks, is merged into
the canary branch, and proceeds with the rest of the release process.

### Testing Plan

Try running `ci:version` and `ci:publish` locally, and handle the
release type via env `RELEASE_TYPE`.

Confirmed the CI force merge on
devjiwonchoi/lab-releases#13

---------

Co-authored-by: Sebastian "Sebbie" Silbermann <sebastian.silbermann@vercel.com>

Author: devjiwonchoi

.github/workflows/build_and_deploy.yml

@@ -20,7 +20,8 @@ env:
   # See https://doc.rust-lang.org/rustc/platform-support/apple-darwin.html#os-version for more details
   MACOSX_DEPLOYMENT_TARGET: 11.0
   # This will become "true" if the latest commit is
-  # "Version Packages", set from check-is-release.js
+  # "Version Packages" or "Version Pacakges (canary)"
+  # set from scripts/check-is-release.js
   __NEW_RELEASE: 'false'
 
 jobs:
@@ -49,7 +50,7 @@ jobs:
         run: |
           # TODO: Remove the new release check once the new release workflow is fully replaced.
           RELEASE_CHECK=$(node ./scripts/check-is-release.js 2> /dev/null || :)
-          if [[ $RELEASE_CHECK =~ ^Version\ Packages$ ]];
+          if [[ $RELEASE_CHECK =~ ^Version\ Packages(\ \(canary\))?$ ]];
           then
             echo "__NEW_RELEASE=true" >> $GITHUB_ENV
           elif [[ $RELEASE_CHECK = v* ]];
@@ -610,6 +611,14 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN_ELEVATED }}
+          RELEASE_TYPE: ${{ github.event.inputs.releaseType }}
+
+      # Add label to verify the PR is created from this workflow.
+      - name: Add label to PR
+        if: steps.changesets.outputs.pullRequestNumber
+        run: 'gh pr edit ${{ steps.changesets.outputs.pullRequestNumber }} --add-label "created-by: CI"'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload npm log artifact
         uses: actions/upload-artifact@v4

.github/workflows/force_merge_canary_release_pr.yml

@@ -0,0 +1,23 @@
+name: Force Merge Canary Release PR
+
+on: pull_request
+
+permissions:
+  # To bypass and merge PR
+  pull-requests: write
+
+jobs:
+  force-merge-canary-release-pr:
+    runs-on: ubuntu-latest
+    # Validate the login, PR title, and the label to ensure the PR is
+    # from the release PR and prevent spoofing.
+    if: |
+      github.event.pull_request.user.login == 'vercel-release-bot' &&
+      github.event.pull_request.title == 'Version Packages (canary)' &&
+      contains(github.event.pull_request.labels.*.name, 'created-by: CI')
+    steps:
+      - name: Bypass required status checks and merge PR
+        run: gh pr merge --admin --squash "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}

.github/workflows/trigger_release_new.yml

@@ -1,15 +1,22 @@
 name: Trigger Release (New)
 
 on:
+  # Run every day at 23:15 UTC
+  # TODO: Disabled cron for now, but uncomment
+  # once replaced the old release workflow.
+  # schedule:
+  #   - cron: '15 23 * * *'
+  # Run manually
   workflow_dispatch:
     inputs:
       releaseType:
         description: Release Type
         required: true
         type: choice
+        # Cron job will run canary release
+        default: canary
         options:
-          # TODO: Follow up enable the case.
-          # - canary
+          - canary
           - stable
           # TODO: Follow up enable the case.
           # - release-candidate
@@ -26,6 +33,10 @@ env:
   TURBO_VERSION: 2.3.3
   NODE_LTS_VERSION: 20
 
+permissions:
+  # To create PR
+  pull-requests: write
+
 jobs:
   start:
     if: github.repository_owner == 'vercel'

package.json

@@ -13,8 +13,8 @@
     "lerna": "lerna",
     "dev": "turbo run dev --parallel",
     "pack-next": "tsx scripts/pack-next.ts",
-    "ci:version": "changeset version && pnpm install --no-frozen-lockfile",
-    "ci:publish": "changeset publish",
+    "ci:version": "tsx ./scripts/release/version-packages.ts",
+    "ci:publish": "tsx ./scripts/release/publish-npm.ts",
     "test-types": "tsc",
     "test-unit": "jest test/unit/ packages/next/ packages/font",
     "test-dev": "cross-env NEXT_TEST_MODE=dev pnpm testheadless",

scripts/check-is-release.js

@@ -13,7 +13,7 @@ const checkIsRelease = async () => {
 
   const versionString = commitMsg.split(' ').pop().trim()
   const publishMsgRegex = /^v\d{1,}\.\d{1,}\.\d{1,}(-\w{1,}\.\d{1,})?$/
-  const newPublishMsgRegex = /^Version Packages$/
+  const newPublishMsgRegex = /^Version Packages( \(canary\))?$/
 
   if (publishMsgRegex.test(versionString)) {
     console.log(versionString)

scripts/release/publish-npm.ts

@@ -0,0 +1,17 @@
+import execa from 'execa'
+
+async function publishNpm() {
+  const releaseType = process.env.RELEASE_TYPE
+  const tag =
+    releaseType === 'canary'
+      ? 'canary'
+      : releaseType === 'release-candidate'
+        ? 'rc'
+        : 'latest'
+
+  await execa('pnpm', ['changeset', 'publish', '--tag', tag], {
+    stdio: 'inherit',
+  })
+}
+
+publishNpm()

scripts/release/version-packages.ts

@@ -0,0 +1,38 @@
+import execa from 'execa'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+
+async function versionPackages() {
+  const preConfigPath = join(process.cwd(), '.changeset', 'pre.json')
+
+  // Exit previous pre mode to prepare for the next release.
+  if (existsSync(preConfigPath)) {
+    if (require(preConfigPath).mode !== 'exit') {
+      // Since current repository is in pre mode, need
+      // to exit before versioning the packages.
+      await execa('pnpm', ['changeset', 'pre', 'exit'], {
+        stdio: 'inherit',
+      })
+    }
+  }
+
+  const releaseType = process.env.RELEASE_TYPE
+
+  if (releaseType === 'canary') {
+    // Enter pre mode as "canary" tag.
+    await execa('pnpm', ['changeset', 'pre', 'enter', 'canary'], {
+      stdio: 'inherit',
+    })
+    // TODO: Create empty changeset for `next` to bump canary version
+    // even if there is no changeset.
+  }
+
+  await execa('pnpm', ['changeset', 'version'], {
+    stdio: 'inherit',
+  })
+  await execa('pnpm', ['install', '--no-frozen-lockfile'], {
+    stdio: 'inherit',
+  })
+}
+
+versionPackages()