Conventional commits for bugfix release automation

[ChristophWurst]

Describe the task

Our stable release management and releases are automated but require a manual trigger. With the help of https://www.conventionalcommits.org/en/v1.0.0/ we could automate and accelerate the release of fixes.

The idea is to automatically do a release every time there are unreleased conventional fixes on a stableX branch.

Requirements

• As an open source community we can't enforce the convention. For repos with more contributions from outside the team we increase the barrier if conventional commits are required.
• Token security: keep npm, github and app store tokens secure.

Concept for apps

Apps regularly have contributions from people outside the team. We can't realistically enforce conventional commits just yet. So the automation is only partial. A human will still need to create the CHANGELOG.md update. The tag, build and upload can be automated.

Add a release action workflow guarded by a Github environment that holds tokens as environment secrets. Only defined reviewers can then approve the workflow. Releases should probably be triggered only manually.

Concept for npm packages

Our three packages are mostly maintained by ourselves. We can risk required conventional commits and leverage full automation.

Add a release action workflow guarded by a Github environment that holds tokens as environment secrets. Only defined reviewers can then approve the workflow. Releases should probably be triggered only manually.

Affected components

• [ ] Calendar
• [ ] Calendar Resource Management
• [ ] Contacts
• [ ] Mail
• [ ] cdav-library
• [ ] nextcloud/calendar-availability-vue
• [x] https://github.com/nextcloud/calendar-js/pull/530

To do

• [x] Create a concept
• [x] Write actions
• [ ] Document process for repo maintainers
• [ ] Document convention for contributors

[github-actions[bot]]

This ticket had no activity recently. @ChristophWurst please adjust the labels if this ticket should stay open and close it otherwise. Learn more about the stale process

[kesselb]

Some tools to help with conventional commits:

https://github.com/conventional-changelog/commitlint https://plugins.jetbrains.com/plugin/13389-conventional-commit https://plugins.jetbrains.com/plugin/14046-commitlint-conventional-commit

[ChristophWurst]

As a personal experiment I migrated https://github.com/ChristophWurst/nextcloud_sentry over to conventional commits

• CI check for PRs
• Dependabot configuration adapted
• Cron action that builds a changelog and release twice a week if there are changes to release

For the nextcloud orga it's a bit more complicated because we have to sync the tags over to https://github.com/nextcloud-releases (or pull them from the other side) to guard the repo secrets.

[ChristophWurst]

POC for an app in our shared org can be found at https://github.com/nextcloud/twofactor_admin/blob/eee6eb3fcfa832b751ea883c2ea98c7120fb0bf7/.github/workflows/release.yml. The workflow runs here, but in an environment that needs approvals. Then tags are pushed over, releases created there as well. In the end this covers the current workflow, just in an automated fashion.

[ChristophWurst]

First release of https://github.com/nextcloud/calendar-js done fully automatic: https://github.com/nextcloud/calendar-js/actions/runs/3788003095

[ChristophWurst]

One of the last pieces of the puzzle – stable branches: https://github.com/nextcloud/calendar-js/pull/540

[ChristophWurst]

I will wrap the final release workflow into a reusable composite action that we can add to our repos.

[ChristophWurst]

I will wrap the final release workflow into a reusable composite action that we can add to our repos.

https://github.com/marketplace/actions/conventional-nextcloud-npm-release

[ChristophWurst]

Works for the small packages we maintain but is not applicable to the apps