Adjust release process to be based on package.json version

.github/release.yml

@@ -0,0 +1,21 @@
+# yaml-language-server: $schema=https://json.schemastore.org/github-release-config.json
+changelog:
+  exclude:
+    labels:
+      - skip-for-release-notes
+  categories:
+    - title: Breaking Changes
+      labels:
+        - breaking-change
+    - title: Enhancements
+      labels:
+        - enhancement
+    - title: Bug Fixes
+      labels:
+        - bug
+    - title: Dependencies
+      labels:
+        - dependencies
+    - title: Other Changes
+      labels:
+        - '*'

.github/workflows/build.yml

@@ -54,5 +54,13 @@ jobs:
         run: pnpm build
 
       - name: Verify committed build output
-        if: ${{ inputs.verify_dist }}
+        if: >-
+          ${{
+            inputs.verify_dist ||
+            (
+              github.event_name == 'pull_request' &&
+              github.event.pull_request.head.repo.full_name == github.repository &&
+              startsWith(github.head_ref, 'release/')
+            )
+          }}
         run: git diff --exit-code

.github/workflows/publish-release.yml

@@ -0,0 +1,138 @@
+name: Publish Release
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'package.json'
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  prepare:
+    if: github.event.repository.fork == false
+    runs-on: ubuntu-latest
+    outputs:
+      should_release: ${{ steps.version.outputs.should_release }}
+      tag: ${{ steps.version.outputs.tag }}
+      version: ${{ steps.version.outputs.version }}
+      major_tag: ${{ steps.version.outputs.major_tag }}
+      previous_tag: ${{ steps.version.outputs.previous_tag }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          ref: ${{ github.sha }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: 24.14.0
+
+      - name: Resolve release version
+        id: version
+        run: |
+          VERSION="$(node --print "require('./package.json').version")"
+
+          if ! printf '%s' "${VERSION}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "package.json version must use x.y.z semver; received ${VERSION}."
+            exit 1
+          fi
+
+          TAG="v${VERSION}"
+          MAJOR_TAG="${TAG%%.*}"
+          PREVIOUS_TAG="$(git describe --tags --abbrev=0 --match 'v[0-9]*.[0-9]*.[0-9]*')"
+
+          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
+          echo "tag=${TAG}" >> "${GITHUB_OUTPUT}"
+          echo "major_tag=${MAJOR_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "previous_tag=${PREVIOUS_TAG}" >> "${GITHUB_OUTPUT}"
+
+          if git rev-parse "${TAG}" >/dev/null 2>&1; then
+            echo 'Release tag already exists. Skipping release.'
+            echo "should_release=false" >> "${GITHUB_OUTPUT}"
+            exit 0
+          fi
+
+          if [ -z "${PREVIOUS_TAG}" ]; then
+            echo 'Expected an existing previous release tag.'
+            exit 1
+          fi
+
+          PREVIOUS_VERSION="${PREVIOUS_TAG#v}"
+
+          if [ "$(printf '%s\n%s\n' "${PREVIOUS_VERSION}" "${VERSION}" | sort -V | sed -n '$p')" != "${VERSION}" ]; then
+            echo "package.json version ${VERSION} must be greater than the latest release tag ${PREVIOUS_TAG}."
+            exit 1
+          fi
+
+          echo "should_release=true" >> "${GITHUB_OUTPUT}"
+
+  test:
+    if: ${{ needs.prepare.outputs.should_release == 'true' }}
+    needs: prepare
+    uses: ./.github/workflows/test.yml
+    with:
+      ref: ${{ github.sha }}
+    permissions:
+      contents: read
+
+  build:
+    if: ${{ needs.prepare.outputs.should_release == 'true' }}
+    needs: prepare
+    uses: ./.github/workflows/build.yml
+    with:
+      ref: ${{ github.sha }}
+      verify_dist: true
+    permissions:
+      contents: read
+
+  release:
+    if: ${{ needs.prepare.outputs.should_release == 'true' }}
+    needs: [prepare, test, build]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      GIT_AUTHOR_NAME: github-actions[bot]
+      GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
+      GIT_COMMITTER_NAME: github-actions[bot]
+      GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          ref: ${{ github.sha }}
+
+      - name: Create and push release tag
+        env:
+          TAG: ${{ needs.prepare.outputs.tag }}
+        run: |
+          git tag -a "${TAG}" -m "Release ${TAG}" "${GITHUB_SHA}"
+          git push origin "refs/tags/${TAG}"
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PREVIOUS_TAG: ${{ needs.prepare.outputs.previous_tag }}
+          TAG: ${{ needs.prepare.outputs.tag }}
+        run: |
+          gh release create "${TAG}" --verify-tag --generate-notes --notes-start-tag "${PREVIOUS_TAG}"
+
+      - name: Update floating major tag
+        env:
+          MAJOR_TAG: ${{ needs.prepare.outputs.major_tag }}
+          RELEASE_SHA: ${{ github.sha }}
+        run: |
+          git tag -fa "${MAJOR_TAG}" -m "Release ${MAJOR_TAG}" "${RELEASE_SHA}"
+          git push origin "refs/tags/${MAJOR_TAG}" --force

.github/workflows/update-dist.yml

@@ -4,24 +4,48 @@ on:
   push:
     branches:
       - master
+  pull_request:
+    branches:
+      - master
+    paths:
+      - 'package.json'
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
 
 concurrency:
-  group: update-dist-${{ github.ref }}
+  group: update-dist-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 permissions:
   contents: write
 
 jobs:
   update-dist:
-    if: github.actor != 'github-actions[bot]'
+    if: >-
+      ${{
+        github.actor != 'github-actions[bot]' &&
+        (
+          (
+            github.event_name == 'push' &&
+            github.event.repository.fork == false
+          ) ||
+          (
+            github.event_name == 'pull_request' &&
+            github.event.pull_request.head.repo.full_name == github.repository &&
+            startsWith(github.head_ref, 'release/') &&
+            contains(fromJSON('["MEMBER", "OWNER"]'), github.event.pull_request.author_association)
+          )
+        )
+      }}
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: master
+          ref: ${{ github.event_name == 'pull_request' && github.head_ref || 'master' }}
           fetch-depth: 0
 
       - name: Setup pnpm
@@ -41,11 +65,30 @@ jobs:
 
       - name: Commit updated dist output
         env:
-          GIT_AUTHOR_NAME: github-actions[bot]
+          BASE_REF: ${{ github.event.pull_request.base.ref || '' }}
+          HEAD_REF: ${{ github.head_ref || '' }}
+          EVENT_NAME: ${{ github.event_name }}
           GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
-          GIT_COMMITTER_NAME: github-actions[bot]
+          GIT_AUTHOR_NAME: github-actions[bot]
           GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: github-actions[bot]
         run: |
+          read_package_version_from_ref() {
+            git show "$1:package.json" | jq -r '.version'
+          }
+
+          if [ "${EVENT_NAME}" = 'pull_request' ]; then
+            git fetch origin "${BASE_REF}"
+
+            VERSION="$(read_package_version_from_ref 'HEAD')"
+            BASE_VERSION="$(read_package_version_from_ref "origin/${BASE_REF}")"
+
+            if [ "${VERSION}" = "${BASE_VERSION}" ]; then
+              echo "Pull request does not bump package.json version. Skipping dist update."
+              exit 0
+            fi
+          fi
+
           if git diff --quiet; then
             echo "No dist updates to commit."
             exit 0
@@ -61,4 +104,9 @@ jobs:
 
           git diff --name-only -z | xargs -0 git add --
           git commit -m "build: update dist for ${SOURCE_SHA}"
-          git push origin HEAD:master
+
+          if [ "${EVENT_NAME}" = 'pull_request' ]; then
+            git push origin "HEAD:${HEAD_REF}"
+          else
+            git push origin HEAD:master
+          fi

CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+Release notes are published on the GitHub releases page:
+
+<https://github.com/elastic/github-actions/releases>