mirror of
https://github.com/heygen-com/hyperframes.git
synced 2026-09-14 18:01:20 +08:00
James Russo
248f640734
* feat(docs): add changelog release workflow * fix(scripts): resolve CodeQL findings in release scripts - draft-changelog.ts: replace existsSync+writeFileSync check-then-act with an atomic exclusive-write flag (flag: wx) to fix the js/file-system-race TOCTOU finding; overwrite only under --force (flag: w). - set-version.ts: switch execSync shell-string git calls to execFileSync with argument arrays so the interpolated version/paths can never be interpreted by a shell, resolving the js/indirect-command-line-injection findings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(scripts): lower writeReleaseNotes complexity below CRAP threshold The exclusive-write fix pushed writeReleaseNotes to cyclomatic 5 / CRAP 30.0 (fallow/high-crap-score, threshold 30.0). The '!force' guard in the catch is redundant — EEXIST is only reachable under the 'wx' flag (force=false), since 'w' overwrites without throwing. Dropping it returns the function to cyclomatic 4 / CRAP 20 with identical behavior. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(docs): address changelog review feedback --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
70 lines
2.5 KiB
Plaintext
70 lines
2.5 KiB
Plaintext
---
|
|
title: Release channels
|
|
description: How HyperFrames keeps alpha-only work out of stable releases.
|
|
---
|
|
|
|
HyperFrames publishes two release channels:
|
|
|
|
- Stable releases use versions like `0.4.24` and publish to the npm `latest` dist-tag.
|
|
- Prereleases use versions like `0.4.24-alpha.1` and publish to the npm dist-tag named by the prerelease suffix, such as `alpha`.
|
|
|
|
## Branch policy
|
|
|
|
Use branch separation to decide what code is eligible for each release channel.
|
|
Dist-tags only control npm install defaults; they do not remove code from a package.
|
|
|
|
- `main` is stable/releasable. Anything merged to `main` is eligible for `latest`.
|
|
- `release/v*` branches are for stable patch releases and hotfixes.
|
|
- `next`, `alpha`, `beta`, `rc`, `canary`, and `prerelease/*` branches are for prerelease integration.
|
|
|
|
If a feature should ship in alpha only, merge or retarget that PR to a prerelease branch instead of `main`.
|
|
|
|
## Stable release
|
|
|
|
Stable releases must be reachable from `origin/main` or `origin/release/v*`.
|
|
Draft and review release notes before creating the release commit:
|
|
|
|
```bash
|
|
bun run changelog:draft <version> --write
|
|
```
|
|
|
|
See [Changelog process](/contributing/changelog-process) for the full workflow. For stable releases, `bun run set-version <version>` enforces this checkpoint before creating the release commit and tag.
|
|
|
|
```bash
|
|
bun run set-version <version>
|
|
git push origin main --tags
|
|
```
|
|
|
|
For hotfixes, branch from the last stable tag, cherry-pick only the fix, publish the patch release, then merge or cherry-pick the same fix back into the prerelease branch.
|
|
|
|
## Alpha release
|
|
|
|
Alpha releases must be reachable from a prerelease branch such as `origin/next` or `origin/alpha`.
|
|
Use the same changelog draft workflow when the prerelease contains changes that users should know about.
|
|
|
|
```bash
|
|
git checkout next
|
|
bun run set-version 0.4.25-alpha.1
|
|
git push origin next
|
|
git push origin v0.4.25-alpha.1
|
|
```
|
|
|
|
Consumers can install alpha builds explicitly:
|
|
|
|
```bash
|
|
npm install hyperframes@alpha
|
|
npm install @hyperframes/core@alpha
|
|
```
|
|
|
|
## CI guardrails
|
|
|
|
The publish workflow validates release channel boundaries before publishing:
|
|
|
|
- Stable versions must publish with `latest`.
|
|
- Prerelease versions must publish with the prerelease dist-tag, such as `alpha`.
|
|
- Stable tags must be reachable from `main` or `release/v*`.
|
|
- Prerelease tags must be reachable from a prerelease branch.
|
|
- Merged `release/vX.Y.Z` PRs publish stable releases only.
|
|
|
|
This prevents an alpha-only feature from being included in a stable hotfix by accident.
|