refactor(release): one command releases every affected artifact

.github/workflows/publish-docker.yml

@@ -31,8 +31,9 @@ env:
   BUN_VERSION: 1.3.13
 
 jobs:
-  # Publish-time safety net. Mirrors `bun run prerelease` so a locally-stale
-  # release machine can't ship a broken image.
+  # Publish-time safety net. Mirrors the checks `bun run release` runs locally
+  # (check, sdk:build, test:sdk) so a locally-stale release machine can't ship
+  # a broken image.
   #
   # The full dashboard integration suite (Postgres + dev server boot) runs in
   # ci.yml on the `push: branches: [main]` event that precedes the tag push,

.github/workflows/publish-npm.yml

@@ -7,8 +7,10 @@ name: Publish npm package
 #   - Manual dispatch → republishes whatever is currently in packages/core/package.json
 #
 # Decoupled from the dashboard's v*.*.* tags so SDK + dashboard can cut
-# releases on independent cadences. Use `bun run release:sdk` to bump
-# packages/core and tag locally (it runs prerelease checks first).
+# releases on independent cadences. `bun run release` (scripts/release.sh)
+# bumps packages/core and tags locally; it releases every artifact affected by
+# the change in one commit, so an SDK fix that the dashboard and extension
+# bundle tags all three at once.
 #
 # Auth — uses npm Trusted Publishing (OIDC), not a token.
 #   - The package's Trusted Publisher config on npmjs.com must match:

README.md

@@ -211,17 +211,27 @@ bun run test:sdk          # SDK tests only (no Postgres required)
 
 Releases are driven by [changelogen](https://github.com/unjs/changelogen) from Conventional Commits.
 
+One command releases everything affected by what's on `main`:
+
+```bash
+bun run release             # patch every affected artifact
+bun run release --minor     # level applies to all affected
+bun run release --dry-run   # print the plan, change nothing
+bun run release --only sdk  # restrict (comma-separated); --skip is the inverse
+```
+
+It works out which artifacts are affected by asking what each one is *built from* — including the SDK bundle that the dashboard bakes into its image and the extension syncs at build time. So a `packages/ui` fix releases the SDK, dashboard **and** extension together, while a dashboard-only change releases just the dashboard. It shows the plan, asks once, then makes a single commit, tags each artifact, and pushes.
+
+Version lines stay independent (`sdk-v0.4.2` / `v0.6.5` / `extension-v0.1.4`), so a dashboard change never forces a churn republish of `@reprojs/core`.
+
+Mixed bump levels compose with `--only`:
+
 ```bash
-bun run release           # patch (default) — dashboard
-bun run release:minor     # minor — dashboard
-bun run release:major     # major — dashboard
-bun run release:sdk       # release the SDK packages
-bun run release:extension # release the Chrome extension (builds + zips for the release page)
-bun run release:all       # release SDK + extension together (BUMP=minor to override)
-bun run postrelease       # push tags to GitHub
+bun run release --minor --only sdk
+bun run release --only dashboard,extension
 ```
 
-The `prerelease` hook runs lint, format:check, SDK build, and SDK tests. CI runs the full gate (including the dashboard integration tests against a real Postgres) on every PR and push to `main`.
+The command runs lint, format:check, SDK build and SDK tests itself, and refuses to tag unless CI is already green on `main`. CI runs the full gate (including the dashboard integration tests against a real Postgres) on every PR and push to `main`.
 
 ---
 

docs/development/index.md

@@ -130,16 +130,27 @@ reprojs/
 Releases are driven by [changelogen](https://github.com/unjs/changelogen) from Conventional Commits. Dashboard, SDK, and the tester extension release on independent tag prefixes so they can version independently.
 
 ```bash
-bun run release           # dashboard — patch bump
-bun run release:minor     # dashboard — minor
-bun run release:major     # dashboard — major
-bun run release:sdk       # SDK packages (tag prefix: sdk-v)
-bun run release:extension # tester extension (tag prefix: extension-v) — builds + zips artifacts
-bun run release:all       # SDK + extension together (set BUMP=minor|major to override)
-bun run postrelease       # push tags to GitHub
+bun run release             # patch every affected artifact
+bun run release --minor     # level applies to all affected
+bun run release --dry-run   # print the plan, change nothing
+bun run release --only sdk  # restrict (comma-separated); --skip is the inverse
+bun run release --yes       # skip the confirm prompt
 ```
 
-The `prerelease` hook runs lint, format:check, SDK build, and SDK tests. Pushing a `v*.*.*` tag triggers `publish-docker` which builds the multi-arch image and pushes to `ripwords/reprojs-dashboard`. Pushing an `sdk-v*.*.*` tag triggers `publish-npm` which publishes `@reprojs/core` with provenance. Pushing an `extension-v*.*.*` tag triggers `publish-extension` which uploads to the Chrome Web Store **and** creates a GitHub Release with the `repro-tester.zip` attached (what testers install unpacked while Web Store review is pending).
+`scripts/release.sh` decides what's affected from what each artifact is *built from*, including bundled workspace packages:
+
+| Artifact | Tag prefix | Built from |
+| --- | --- | --- |
+| sdk | `sdk-v` | `packages/{core,ui,sdk-utils,shared,recorder}` |
+| dashboard | `v` | `apps/dashboard`, `packages/integrations` **+ bundles the SDK** |
+| extension | `extension-v` | `apps/extension` **+ bundles the SDK** |
+| expo | `expo-v` | `packages/expo`, `packages/{sdk-utils,shared}` |
+
+Propagation needs no special rule: the dashboard bakes the SDK IIFE into its image and the extension syncs it via `sync-sdk.ts`, so listing the SDK as a source is what makes a `packages/ui` fix release all three. Expo deliberately omits `packages/ui` — it ships its own React Native UI. Release commits are excluded from detection, otherwise a release's own version bump would make the next one look necessary forever.
+
+Everything lands in **one commit** with one tag per artifact, gated once on green CI. Tags are annotated — lightweight tags are silently skipped by `git push --follow-tags`, which previously meant a tag never reached the remote and its publish workflow never fired. Tags are pushed one at a time because GitHub won't start workflow runs for tags beyond the third in a single push.
+
+Pushing a `v*.*.*` tag triggers `publish-docker` which builds the multi-arch image and pushes to `ripwords/reprojs-dashboard`. Pushing an `sdk-v*.*.*` tag triggers `publish-npm` which publishes `@reprojs/core` with provenance. Pushing an `extension-v*.*.*` tag triggers `publish-extension` which uploads to the Chrome Web Store **and** creates a GitHub Release with the `repro-tester.zip` attached (what testers install unpacked while Web Store review is pending).
 
 ## Where to file bugs / ideas
 

package.json

@@ -37,15 +37,7 @@
     "docs:preview": "vitepress preview docs",
     "prepare": "husky",
     "fix": "bun run fmt && bun run lint:fix",
-    "prerelease": "bun run check && bun run sdk:build && bun run test:sdk",
-    "release": "bash ./scripts/release-dashboard.sh",
-    "release:minor": "bash ./scripts/release-dashboard.sh --minor",
-    "release:major": "bash ./scripts/release-dashboard.sh --major",
-    "postrelease": "git push --follow-tags",
-    "release:sdk": "bash ./scripts/release-sdk.sh",
-    "release:expo": "bash ./scripts/release-expo.sh",
-    "release:extension": "bash ./scripts/release-extension.sh",
-    "release:all": "bash ./scripts/release-sdk.sh ${BUMP:-patch} && bash ./scripts/release-expo.sh ${BUMP:-patch} && bash ./scripts/release-extension.sh ${BUMP:-patch}"
+    "release": "bash ./scripts/release.sh"
   },
   "devDependencies": {
     "@types/bun": "^1.3.12",

scripts/lib/scope-changelog.sh

@@ -41,12 +41,28 @@ filter_changelog_by_paths() {
   # awk filter: each line either has a [shorthash] commit ref OR doesn't.
   # If it has one, keep the line iff the SHA is in our kept set. Lines
   # without a ref (headers, blanks, "compare changes" links) pass through.
+  #
+  # Crucially this only applies to the section changelogen just prepended —
+  # everything from the SECOND `## ` heading down is previously-released
+  # history and is copied through untouched.
+  #
+  # It used to filter the whole file. The keep-set only covers FROM..HEAD, so
+  # every past release's bullets referenced SHAs outside the range and were
+  # silently deleted — each release eroding the changelog a bit more.
+  # packages/core/CHANGELOG.md lost its sdk-v0.4.0 entry down from 257 bullets
+  # to 2 that way, and that gutted file is what ships to npm and gets pasted
+  # into the GitHub Release.
+  #
+  # `## ` matches version headings only: `### Fixes` has no space in the third
+  # column, so subsection headings don't increment the counter.
   awk -v sha_file="$sha_file" '
     BEGIN {
       while ((getline line < sha_file) > 0) keep[line] = 1
       close(sha_file)
     }
+    /^## / { sections++ }
     {
+      if (sections >= 2) { print; next }
       if (match($0, /\[[a-f0-9]{7,12}\]/) > 0) {
         sha = substr($0, RSTART + 1, RLENGTH - 2)
         if (!(sha in keep)) next
@@ -57,16 +73,10 @@ filter_changelog_by_paths() {
   mv "${CHANGELOG}.tmp" "$CHANGELOG"
   rm -f "$sha_file"
 }
-
-# Amend the just-created release commit + recreate the tag at the new HEAD.
-# changelogen creates the commit + tag atomically inside `--release`, so the
-# only way to inject a CHANGELOG post-process is to amend after the fact and
-# move the tag forward.
-amend_release_commit_and_retag() {
-  local TAG="$1"
-  git add -A
-  if ! git diff --cached --quiet; then
-    git commit --amend --no-edit --no-verify >/dev/null
-  fi
-  git tag -f "$TAG" >/dev/null
-}
+# NOTE: amend_release_commit_and_retag() used to live here. It amended
+# changelogen's commit and re-tagged with `git tag -f` — a LIGHTWEIGHT tag.
+# Every release script then told you to run `git push --follow-tags`, which
+# pushes annotated tags only, so those pushes silently no-op'd: no tag on the
+# remote, no publish workflow, no error. release.sh now passes --no-commit
+# --no-tag to changelogen and creates annotated tags itself, so there's
+# nothing to amend.