Create git tags and GitHub releases after publishing

When changesets/action published packages itself, it also pushed a
name@version tag and created a GitHub release with the changelog entry
for each package. Publishing through ESRP dropped both. Recreate them
from the publish manifest once publishing finishes, so a release looks
the same as before.

This reuses the GitHub App token template from tslib's release pipeline,
since release jobs have no checkout to run the token CLI from.

Author: jakebailey

build/azure-pipelines/pack-changed-packages.mjs

@@ -100,6 +100,21 @@ function versionChanged(pkg) {
   return previous?.version !== pkg.packageJson.version;
 }
 
+// Match changesets/action, which uses the package's CHANGELOG.md section for
+// the version as the GitHub release body.
+function readReleaseNotes(pkg) {
+  const changelogPath = path.join(root, pkg.dir, "CHANGELOG.md");
+  if (!fs.existsSync(changelogPath)) return "";
+
+  const lines = fs.readFileSync(changelogPath, "utf8").split(/\r?\n/);
+  const start = lines.findIndex(line => line.trim() === `## ${pkg.packageJson.version}`);
+  if (start === -1) return "";
+
+  let end = lines.findIndex((line, i) => i > start && /^##?\s/.test(line));
+  if (end === -1) end = lines.length;
+  return lines.slice(start + 1, end).join("\n").trim();
+}
+
 function findChangedPackageNames() {
   const releaseBranch = `refs/heads/${readJson(path.join(root, ".changeset/config.json")).baseBranch}`;
   const sourceBranch = process.env.BUILD_SOURCEBRANCH;
@@ -157,6 +172,7 @@ for (const name of packedNames) {
     name,
     version: packedPackage.version,
     filename,
+    releaseNotes: readReleaseNotes(packages.get(name)),
   });
 }
 

build/azure-pipelines/release-helper.mjs

@@ -67,11 +67,84 @@ async function prepareStage(stage) {
   setVariable(`PublishStage${stage}`, pending > 0);
 }
 
+function requireEnv(name) {
+  const value = process.env[name];
+  if (!value) throw new Error(`${name} is required.`);
+  return value;
+}
+
+async function githubRequest(route, method = "GET", body) {
+  const repository = requireEnv("GITHUB_REPOSITORY");
+  const response = await fetch(`https://api.github.com/repos/${repository}/${route}`, {
+    method,
+    headers: {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${requireEnv("GH_TOKEN")}`,
+      "Content-Type": "application/json",
+      "X-GitHub-Api-Version": "2022-11-28",
+    },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  if (method === "GET" && response.status === 404) return undefined;
+  if (!response.ok) {
+    throw new Error(`${method} ${route}: ${response.status} ${await response.text()}`);
+  }
+  return response.json();
+}
+
+async function ensureTag(tag, commit) {
+  const ref = await githubRequest(`git/ref/tags/${tag}`);
+  if (!ref) {
+    await githubRequest("git/refs", "POST", { ref: `refs/tags/${tag}`, sha: commit });
+    console.log(`Created tag ${tag}.`);
+    return;
+  }
+
+  let object = ref.object;
+  while (object.type === "tag") {
+    object = (await githubRequest(`git/tags/${object.sha}`)).object;
+  }
+  if (object.type !== "commit" || object.sha !== commit) {
+    throw new Error(`Tag ${tag} already exists but does not point to ${commit}.`);
+  }
+  console.log(`Tag ${tag} already exists.`);
+}
+
+async function ensureRelease(tag, pkg) {
+  const release = await githubRequest(`releases/tags/${tag}`);
+  if (release) {
+    console.log(`GitHub release ${tag} already exists: ${release.html_url}`);
+    return;
+  }
+
+  const created = await githubRequest("releases", "POST", {
+    tag_name: tag,
+    name: tag,
+    body: pkg.releaseNotes,
+    prerelease: pkg.version.includes("-"),
+  });
+  console.log(`Created GitHub release: ${created.html_url}`);
+}
+
+// Recreate what changesets/action does after `changeset publish`: a
+// name@version tag and a GitHub release for every published package.
+async function finalize() {
+  const commit = requireEnv("RELEASE_SOURCE_COMMIT");
+  for (const pkg of manifest.stages.flat()) {
+    const tag = spec(pkg);
+    await ensureTag(tag, commit);
+    await ensureRelease(tag, pkg);
+  }
+}
+
 const [command, ...args] = process.argv.slice(2);
 switch (command) {
   case "prepare-stage":
     await prepareStage(Number(args[0]));
     break;
+  case "finalize":
+    await finalize();
+    break;
   default:
     throw new Error(`Unknown command ${command}`);
 }

build/azure-pipelines/release.yml

@@ -12,6 +12,9 @@ variables:
   ReleaseOwners: "jabaile@microsoft.com"
   ReleaseApprovers: "alexchi@microsoft.com"
   NpmArtifactName: npm-packages
+  GitHubRepository: microsoft/TypeScript-Website
+  TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID: Iv23li4GolzJSEp1mzHI
+  TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID: https://jststeam-passwords.vault.azure.net/keys/typescript-automation
 
 parameters:
   - name: publishStages
@@ -144,3 +147,41 @@ extends:
                     waitForReleaseCompletion: true
                     owners: "$(ReleaseOwners)"
                     approvers: "$(ReleaseApprovers)"
+
+      - stage: Finalize
+        displayName: Create tags and GitHub releases
+        dependsOn:
+          - Build
+          - Publish
+        condition: and(succeeded(), eq(dependencies.Build.outputs['Build.packChangedPackages.ShouldPublish'], 'true'))
+        jobs:
+          - job: CreateGitHubReleases
+            displayName: Create tags and GitHub releases
+            templateContext:
+              type: releaseJob
+              isProduction: true
+              inputs:
+                - input: pipelineArtifact
+                  artifactName: $(NpmArtifactName)
+                  targetPath: $(Pipeline.Workspace)/$(NpmArtifactName)
+            steps:
+              - checkout: none
+
+              - task: UseNode@1
+                inputs:
+                  version: "22.x"
+                displayName: "Install Node.js"
+
+              - template: /build/azure-pipelines/steps/create-github-app-token.yml@self
+                parameters:
+                  azureSubscription: TypeScript-DevDiv-KeyVault
+                  repositories: TypeScript-Website
+                  permissions: contents:write
+                  insertSteps:
+                    - script: node "$(Pipeline.Workspace)/$(NpmArtifactName)/release-helper.mjs" finalize
+                      displayName: Create tags and GitHub releases
+                      env:
+                        GH_TOKEN: $(GH_TOKEN)
+                        GITHUB_REPOSITORY: $(GitHubRepository)
+                        RELEASE_SOURCE_COMMIT: $(Build.SourceVersion)
+                        NODE_USE_ENV_PROXY: "1"