feat(ci): add pkg.pr.new canary releases - #874
Conversation
Publishes a preview build of @raystack/apsara to pkg.pr.new on every PR and push to main, so changes can be installed and tested before a real npm release. Document the workflow in CONTRIBUTING.md and add install instructions to the getting-started docs.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThe PR adds a GitHub Actions canary workflow for pull requests and pushes to Sequence Diagram(s)sequenceDiagram
participant GitHubActions as GitHub Actions
participant NodePnpm as pnpm and Node.js
participant Apsara
participant PkgPrNew as pkg.pr.new
GitHubActions->>NodePnpm: Configure Node.js 22 and pnpm 9
NodePnpm->>Apsara: Install frozen dependencies
Apsara->>Apsara: Build Apsara
Apsara->>PkgPrNew: Publish preview package
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
pnpm exec requires the binary to be installed, unlike npx/dlx. The canary workflow was failing with "Command pkg-pr-new not found".
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (4)
.github/workflows/canary.yaml (3)
20-21: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable checkout credential persistence.
Pull-request runs execute code from the pull request.
actions/checkout@v4persistsGITHUB_TOKENfor later steps unlesspersist-credentials: falseis set.permissions: {}limits the token, but opting out removes the credential from the workspace and protects against future permission changes. (github.com)Proposed fix
- name: Checkout 🛎️ uses: actions/checkout@v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/canary.yaml around lines 20 - 21, Update the actions/checkout@v4 step in the canary workflow to set persist-credentials to false, ensuring checkout does not retain GITHUB_TOKEN credentials for subsequent steps while preserving the existing checkout behavior.Source: Linters/SAST tools
41-41: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winUse a unique preview version.
@raystack/apsaracurrently declares version0.48.0. pkg.pr.new keeps the source version by default and documents possible collisions with later npm releases and lockfiles. Add--previewVersionso preview installs use a distinct version. (github.com)Proposed fix
- run: pnpm exec pkg-pr-new publish ./packages/raystack --comment=update + run: pnpm exec pkg-pr-new publish ./packages/raystack --previewVersion --comment=update🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/canary.yaml at line 41, Update the pkg-pr-new publish command in the canary workflow to include the --previewVersion option, ensuring generated preview packages use a unique version while preserving the existing package path and --comment=update behavior.
14-18: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winCancel stale preview runs.
Multiple runs can execute concurrently for rapid pushes. Because
--comment=updateedits an existing preview comment, an older run can finish after a newer run and leave stale publish information in that comment. Add a concurrency group keyed by pull request number or ref. GitHub Actions permits concurrent runs by default and supportscancel-in-progressfor this case. (docs.github.com)Proposed fix
permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/canary.yaml around lines 14 - 18, Add a GitHub Actions concurrency configuration to the workflow, keyed by the pull request number or ref, with cancel-in-progress enabled so newer publish jobs supersede stale runs. Keep the existing publish job settings unchanged.CONTRIBUTING.md (1)
278-289: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winDocument the installation path for main previews.
The workflow also publishes on direct pushes to
main, but this section only provides a pull-request comment command. A directmainpush may not have a pull request comment. Add amainpreview link or a link to the repository's pkg.pr.new page, and state which URL users should install. pkg.pr.new documents branch tags for in-repository branches. (github.com)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CONTRIBUTING.md` around lines 278 - 289, Update the “Canary Releases” section to document how to install previews published from direct pushes to main, including the repository’s pkg.pr.new main/branch preview URL and the exact URL users should install when no pull-request comment is available. Preserve the existing pull-request installation guidance.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/canary.yaml:
- Line 41: Update the pkg-pr-new publish step in the canary workflow to publish
the built packages/raystack artifact rather than the workspace source. Ensure
this step runs after the build step so generated outputs are available, while
preserving the existing preview comment behavior.
- Around line 7-8: Update the canary workflow’s pull_request trigger to run for
pull requests targeting any branch by removing the branches filter. Preserve the
existing canary preview behavior and keep the documentation’s claim that every
pull request receives a preview build accurate.
In `@CONTRIBUTING.md`:
- Around line 284-286: Update both preview installation snippets in
CONTRIBUTING.md to use the composite repository’s resolved metadata rather than
`@raystack/apsara`’s package metadata, or replace them with full pkg.pr.new URLs.
Ensure both documented commands remain valid for installing the preview package.
---
Nitpick comments:
In @.github/workflows/canary.yaml:
- Around line 20-21: Update the actions/checkout@v4 step in the canary workflow
to set persist-credentials to false, ensuring checkout does not retain
GITHUB_TOKEN credentials for subsequent steps while preserving the existing
checkout behavior.
- Line 41: Update the pkg-pr-new publish command in the canary workflow to
include the --previewVersion option, ensuring generated preview packages use a
unique version while preserving the existing package path and --comment=update
behavior.
- Around line 14-18: Add a GitHub Actions concurrency configuration to the
workflow, keyed by the pull request number or ref, with cancel-in-progress
enabled so newer publish jobs supersede stale runs. Keep the existing publish
job settings unchanged.
In `@CONTRIBUTING.md`:
- Around line 278-289: Update the “Canary Releases” section to document how to
install previews published from direct pushes to main, including the
repository’s pkg.pr.new main/branch preview URL and the exact URL users should
install when no pull-request comment is available. Preserve the existing
pull-request installation guidance.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: c89899a8-f8f9-4576-8523-28029b86c7c1
📒 Files selected for processing (3)
.github/workflows/canary.yamlCONTRIBUTING.mdapps/www/src/content/docs/(overview)/getting-started.mdx
| run: pnpm build:apsara | ||
|
|
||
| - name: Publish 🚀 | ||
| run: pnpm exec pkg-pr-new publish ./packages/raystack --comment=update |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow line =="
cat -n .github/workflows/canary.yaml | sed -n '35,45p'
echo
echo "== pkg.pr.new related docs/config =="
rg -n "pkg\.pr\.new|pkg-pr-new|--commentWithSha|--packageManager|commentWithSha|packageManager" -S .github README.md packages 2>/dev/null || true
echo
echo "== package manager/package info =="
for f in package.json pnpm-workspace.yaml pnpm-lock.yaml; do
if [ -f "$f" ]; then
echo "--- $f ---"
sed -n '1,120p' "$f"
fi
doneRepository: raystack/apsara
Length of output: 6132
🌐 Web query:
pkg.pr.new packageManager commentWithSha npm install snippets PR-number URLs defaults
💡 Result:
pkg.pr.new is a tool for creating continuous, npm-compatible preview releases directly from your GitHub pull requests and commits without publishing to the npm registry [1][2]. Below are the details regarding the configuration flags you inquired about: --commentWithSha This flag controls the format of the installation URLs generated in the GitHub comments posted by the bot [3]. - When set to true, the bot uses the commit SHA instead of the pull request number in the generated install commands (e.g., npm i https://pkg.pr.new/package@a832a55) [3]. - When set to false (default), it uses the pull request number (e.g., npm i https://pkg.pr.new/package@123), which can sometimes lead to caching issues because the URL remains the same for different commits within the same PR [4][3]. --packageManager=XYZ This flag allows you to customize the package manager syntax reflected in the bot's comments [1][3]. - Supported values for XYZ are: npm (default), pnpm, yarn, or bun [1][5]. - You can provide multiple comma-separated values (e.g., --packageManager=npm,pnpm) to show snippets for different package managers simultaneously [1][2]. Additional Context: - Usage: These flags are typically passed to the pkg-pr-new command in your GitHub Actions workflows (e.g., pnpm exec pkg-pr-new publish --commentWithSha --packageManager=npm,pnpm) [6][1][5]. - Defaults: By default, the tool uses npm as the package manager and includes the pull request number in the comment links [5][3]. - Other Flags: The tool also offers --bin (to show npx execute commands instead of install commands for CLI apps) and --no-compact (to force long-form URLs) [1][2][5]. For more control, you can use --comment=off in combination with the --json flag to generate metadata and create your own custom GitHub comments via the GitHub Actions API [2][7].
Citations:
- 1: https://github.com/stackblitz-labs/pkg.pr.new
- 2: https://github.com/stackblitz-labs/pkg.pr.new/blob/main/README.md
- 3: stackblitz-labs/pkg.pr.new@v0.0.62...v0.0.63
- 4: The address of the bot comment does not contain the updated code. stackblitz-labs/pkg.pr.new#235
- 5: https://github.com/stackblitz-labs/pkg.pr.new/blob/main/packages/cli/index.ts
- 6: https://pkg.pr.new/
- 7: https://github.com/stackblitz-labs/pkg.pr.new?tab=readme-ov-file
Publish pkg.pr.new previews for the pnpm workspace.
pnpm exec pkg-pr-new publish ./packages/raystack publishes the workspace package source rather than a built package, which can produce install commands that do not resolve correctly. Publish packages/raystack after the build step, or use the built artifact path.
🧰 Tools
🪛 zizmor (1.28.0)
[info] 41-41: prefer trusted publishing for authentication (use-trusted-publishing): this command
(use-trusted-publishing)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/canary.yaml at line 41, Update the pkg-pr-new publish step
in the canary workflow to publish the built packages/raystack artifact rather
than the workspace source. Ensure this step runs after the build step so
generated outputs are available, while preserving the existing preview comment
behavior.
- Fix the documented install URL: pkg.pr.new URLs are scoped by <owner>/<repo>/<package>@<ref>, not just <package>@<ref> - Document the install path for canary builds published from direct pushes to main, which don't have a PR to comment on - Drop persist-credentials on checkout since the job builds and runs PR code - Cancel superseded runs so a stale run can't overwrite a newer one's PR comment
pkg.pr.new only shortens preview URLs to <package>@<ref> when the currently published npm version has a valid repository field — otherwise it falls back to the long owner/repo/<package>@<ref> form. This takes effect starting with the next npm release.
| run: pnpm build:apsara | ||
|
|
||
| - name: Publish 🚀 | ||
| run: pnpm exec pkg-pr-new publish ./packages/raystack --comment=update |
There was a problem hiding this comment.
Let's use the --packageManager=pnpm flag to shown pnpm in the generated comments
| run: pnpm build:apsara | ||
|
|
||
| - name: Publish 🚀 | ||
| run: pnpm exec pkg-pr-new publish ./packages/raystack --comment=update |
There was a problem hiding this comment.
Also I think we should use --previewVersion
Use --previewVersion to rewrite every published package's version to 0.0.0-preview- before packing (working tree is restored afterward):
pnpm exec pkg-pr-new publish --previewVersion './packages/*'
For example, 1.0.0 becomes 0.0.0-preview-a832a55. The 0.0.0- prefix cannot satisfy a normal semver range for a real release, so lockfile collisions with npm versions are avoided.
From their docs^
Run canary previews for PRs targeting any branch, use --previewVersion to avoid colliding with the real npm version, and use --packageManager=pnpm so generated install snippets match this pnpm-only repo.
2 participants
Summary
.github/workflows/canary.yamlto publish a preview build of@raystack/apsarato pkg.pr.new on every PR and push tomain, so changes can be installed and tested before a real npm releaseCONTRIBUTING.mdTest plan