You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
validate inputs → build both packages → npm publish --dry-run → show package contents + version in summary
12
13
|
13
14
v
14
-
flowise-embed: bump version -> install -> build -> npmpublish -> commit + tag + push
15
+
reviewer approves (npm-publish environment gate)
15
16
|
16
17
v
17
-
poll npm registry until new version is available
18
+
publish job:
19
+
flowise-embed: set version → install → build → npm publish --tag <tag> → create version bump PR
18
20
|
19
21
v
20
-
flowise-embed-react: update dep + version -> install (updates yarn.lock) -> build -> npm publish -> commit + tag + push
22
+
poll npm registry until new version is available
23
+
|
24
+
v
25
+
flowise-embed-react: update dep + version → install → build → npm publish --tag <tag> → create version bump PR
21
26
```
22
27
23
28
## Usage
24
29
25
30
### Publishing a new version
26
31
27
32
1. Go to **Actions** > **"Publish flowise-embed + flowise-embed-react"** > **Run workflow**
28
-
2. Set `bump_type`:
29
-
-`patch` — 3.1.2 -> 3.1.3
30
-
-`minor` — 3.1.2 -> 3.2.0
31
-
-`major` — 3.1.2 -> 4.0.0
32
-
- Or an exact version like `3.2.0`
33
-
3. Leave `recovery_version` empty
34
-
4. Approve the environment gate when prompted
35
-
5. Both packages publish to npm and both repos receive a version commit + git tag
33
+
2. Set `bump`:
34
+
-`patch` — 3.1.3 → 3.1.4
35
+
-`minor` — 3.1.3 → 3.2.0
36
+
-`major` — 3.1.3 → 4.0.0
37
+
-`prerelease` — 3.1.3 → 3.1.4-dev.0
38
+
-`custom` — set any exact version in the `custom_version` field
39
+
3. Set `tag`:
40
+
-`latest` (default) — all `npm install flowise-embed` users get this version
41
+
-`dev` — only `npm install flowise-embed@dev` users get this version
42
+
4. Leave `recovery_version` empty
43
+
5.**Review the dry-run job summary** — check the resolved version, package contents, and dry-run publish output
44
+
6.**Approve the publish job** via the `npm-publish` environment gate
45
+
7. Both packages publish to npm and version bump PRs are created in both repos
46
+
47
+
Or via CLI:
48
+
49
+
```shell
50
+
gh workflow run publish.yml -f bump=patch -f tag=latest
51
+
gh workflow run publish.yml -f bump=prerelease -f tag=dev
52
+
gh workflow run publish.yml -f bump=custom -f custom_version=3.2.0 -f tag=latest
53
+
```
36
54
37
55
### Recovery
38
56
39
57
If `flowise-embed` published successfully but `flowise-embed-react` failed:
40
58
41
59
1. Go to **Actions** > **"Publish flowise-embed + flowise-embed-react"** > **Run workflow**
42
-
2. Leave `bump_type` at default (it won't be used)
43
-
3. Set `recovery_version` to the version already published, e.g. `3.1.3`
44
-
4. Approve the environment gate
45
-
5. All `flowise-embed` steps are skipped — only `flowise-embed-react` is built and published
60
+
2. Leave `bump` at default (it won't be used)
61
+
3. Set `recovery_version` to the version already published, e.g. `3.1.4`
62
+
4. Review dry-run and approve the publish job
63
+
5. All `flowise-embed` steps are skipped — only `flowise-embed-react` is built, published, and gets a version bump PR
64
+
65
+
### Prerelease versions
66
+
67
+
Use `bump: prerelease` with `tag: dev` to publish dev versions:
68
+
69
+
| Current version | After prerelease bump |
70
+
| --------------- | --------------------- |
71
+
|`3.1.3`|`3.1.4-dev.0`|
72
+
|`3.1.4-dev.0`|`3.1.4-dev.1`|
73
+
|`3.1.4-dev.1`|`3.1.4-dev.2`|
74
+
75
+
Promote to stable with `bump: patch` (or `minor`/`major`) and `tag: latest`.
76
+
77
+
### Verifying a publish
78
+
79
+
After the publish job completes, confirm both packages are on npm with matching versions:
80
+
81
+
```shell
82
+
# Check specific version exists
83
+
npm view flowise-embed@<version> version
84
+
npm view flowise-embed-react@<version> version
85
+
86
+
# Check dist-tag points to the right version
87
+
npm view flowise-embed@latest version
88
+
npm view flowise-embed-react@dev version
89
+
90
+
# Check the version bump PRs were created
91
+
gh pr list --search "chore: bump flowise-embed"
92
+
gh pr list --repo FlowiseAI/FlowiseEmbedReact --search "chore: bump flowise-embed-react"
93
+
```
94
+
95
+
### Important: merge PRs before next publish
96
+
97
+
The workflow reads the current version from `package.json` on `main`. Since version bumps are delivered via PR (not direct push), you **must merge the version bump PRs before running the workflow again** — otherwise it will resolve to the same version and fail because it already exists on npm.
46
98
47
99
## Setup
48
100
49
101
### Secrets
50
102
51
-
Add to **FlowiseChatEmbed** repo settings:
103
+
Add to **FlowiseChatEmbed** repo settings (repository-level, not environment-level):
|`NPM_TOKEN`| npm **Automation** token with publish access to both `flowise-embed` and `flowise-embed-react`. Use the "Automation" type so it bypasses 2FA in CI. |
56
-
|`PAT_GITHUB`| GitHub Personal Access Token with access to both `FlowiseChatEmbed` and `FlowiseEmbedReact` repos. |
108
+
|`PAT_GITHUB`| GitHub Personal Access Token with write access to both `FlowiseChatEmbed` and `FlowiseEmbedReact` repos. |
109
+
110
+
**Important:** Secrets must be **repository-level** (not environment-level) so the dry-run job can access them.
57
111
58
112
#### PAT options
59
113
60
114
-**Classic PAT:**`repo` scope
61
-
-**Fine-grained PAT (recommended):** Scope to the FlowiseAI org, select both repos, grant `Contents: Read and write`
115
+
-**Fine-grained PAT (recommended):** Scope to the FlowiseAI org, select both repos, grant `Contents: Read and write` and `Pull requests: Read and write`
62
116
63
-
### Environment
117
+
##How it works
64
118
65
-
Create a `production` environment in **FlowiseChatEmbed** repo:
119
+
### Two-job structure
66
120
67
-
This gates every workflow run behind a human approval step.
121
+
Every publish goes through two jobs:
68
122
69
-
## How it works
123
+
1.**dry-run** — builds both packages, runs `npm pack --dry-run` and `npm publish --dry-run`, displays the resolved version and package contents in the job summary. No approval needed — runs immediately.
124
+
2.**publish** — gated behind the `npm-publish` environment. Only runs after a reviewer approves. Publishes to npm and creates version bump PRs.
70
125
71
-
### Version bump
126
+
### Version resolution
72
127
73
-
`npm version <bump_type> --no-git-tag-version` updates `package.json` without creating npm's default `v3.1.3` tag. The workflow controls the exact tag format: `flowise-embed@3.1.3`.
128
+
`npx semver` computes the new version from the current `package.json` version and the bump type. For `custom`, the input is validated as valid semver. For `prerelease`, versions use the `dev` pre-id (e.g. `3.1.4-dev.0`).
129
+
130
+
### Dist-tags
131
+
132
+
Both packages are published with the same dist-tag. Use `latest` for stable releases and `dev` for pre-releases. The workflow warns (but doesn't block) if a prerelease version is published with `latest` or a stable version with `dev`.
74
133
75
134
### Dependency update in FlowiseEmbedReact
76
135
77
-
The workflow sets `devDependencies.flowise-embed` to the exact new version using `npm pkg set`. This changes the specifier (e.g. from `"latest"` to `"3.1.3"`), which forces yarn to re-resolve from the registry and update `yarn.lock`. Both `package.json` and `yarn.lock` are committed back to the repo.
136
+
The workflow sets `devDependencies.flowise-embed` to the exact new version using `npm pkg set`. This changes the specifier (e.g. from `"latest"` to `"3.1.4"`), which forces yarn to re-resolve from the registry and update `yarn.lock`. Both `package.json` and `yarn.lock` are included in the version bump PR.
78
137
79
138
### npm registry propagation
80
139
81
140
After publishing `flowise-embed`, there's a short delay before the version is available on the registry. The workflow polls `npm view` every 10 seconds for up to 2 minutes before proceeding to the `flowise-embed-react` steps.
82
141
142
+
### Version bump PRs
143
+
144
+
After publishing, the workflow creates version bump PRs in both repos instead of pushing directly to main:
`HUSKY=0` is set during `yarn install`for FlowiseChatEmbed to prevent the `prepare` script (`husky install`) from failing in CI where there's no git hook context.
153
+
`HUSKY=0` is set during `yarn install` to prevent the `prepare` script (`husky install`) from failing in CI.
If npm publish succeeds but PR creation fails (e.g. permissions issue, branch already exists), the packages are already on npm — no rollback needed. You can manually create the version bump PR or push the version change directly. The PR step failing does not affect the published packages.
0 commit comments