Skip to content

ci: automated release workflow (semantic-release + OIDC trusted publishing) #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oliverlaz merged 11 commits into from
Jul 28, 2026
Merged

ci: automated release workflow (semantic-release + OIDC trusted publishing) #46

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
98b99a2
ci: add automated release workflow with semantic-release and OIDC
oliverlaz Jun 11, 2026
807fb2b
ci: pass GITHUB_TOKEN to the semantic-release step
oliverlaz Jun 11, 2026
a6cbefa
ci: adopt shared setup-node action and remove stale bot
oliverlaz Jun 11, 2026
65aee1d
chore: adjust the README.md
oliverlaz Jun 11, 2026
d3a7d66
chore: adjust the README.md
oliverlaz Jun 11, 2026
60e2b62
ci: drop redundant root npm install steps
oliverlaz Jun 11, 2026
6e59f3f
Merge branch 'master' into ci/automated-release-workflow
oliverlaz Jul 28, 2026
1b13c47
ci: add alpha prerelease channel to semantic-release config
oliverlaz Jul 28, 2026
be82633
docs: document the release branch/channel mapping
oliverlaz Jul 28, 2026
9674327
chore(deps): bump semantic-release to ^25.0.8
oliverlaz Jul 28, 2026
24e9941
ci: grant issues/PR write permissions and serialize releases
oliverlaz Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .github/actions/setup-node/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
name: Setup Node
description: Setup Node from .nvmrc and install dependencies with npm
inputs:
node-version:
description: Optional Node version override
required: false
runs:
using: composite
steps:
- uses: actions/setup-node@v6
with:
node-version: ${{ inputs.node-version }}
node-version-file: .nvmrc
cache: npm

- name: Install dependencies
shell: bash
run: npm ci # respects .npmrc (legacy-peer-deps=true)
15 changes: 0 additions & 15 deletions .github/stale.yml
View file
Open in desktop

This file was deleted.

12 changes: 3 additions & 9 deletions .github/workflows/android_ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,19 +16,13 @@ jobs:
android-compile:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
- uses: actions/checkout@v6
- uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '17'
- uses: actions/setup-node@v4
with:
node-version: '22.x'
cache: 'npm'
cache-dependency-path: '**/package-lock.json'

- name: Install node modules
run: npm install
- uses: ./.github/actions/setup-node

- name: Install example node modules
run: npm install
Expand Down
7 changes: 2 additions & 5 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,8 @@ jobs:
name: Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 22
- run: npm install
- uses: actions/checkout@v6
- uses: ./.github/actions/setup-node
- name: Check if the git repository is clean
run: $(exit $(git status --porcelain --untracked-files=no | head -255 | wc -l)) || (echo "Dirty git tree"; git diff; exit 1)
- run: npm run lint
12 changes: 2 additions & 10 deletions .github/workflows/ios_ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,13 +17,8 @@ jobs:
ios-compile:
runs-on: macos-latest
steps:
- uses: actions/checkout@v4

- uses: actions/setup-node@v4
with:
node-version: '22.x'
cache: 'npm'
cache-dependency-path: '**/package-lock.json'
- uses: actions/checkout@v6

@coderabbitai coderabbitai Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow files =="
git ls-files '.github/workflows/*' | sed -n '1,120p'

echo
echo "== ios_ci.yml with line numbers =="
if [ -f .github/workflows/ios_ci.yml ]; then
  nl -ba .github/workflows/ios_ci.yml | sed -n '1,220p'
fi

echo
echo "== checkout persist-credentials/default usage across workflows =="
rg -n --hidden --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' 'actions/checkout|persist-credentials|permissions:|GITHUB_TOKEN|git ' .github/workflows || true

echo
echo "== local composite actions mentioning checkout/default credentials =="
fd -e yml -e yaml . .github -d 3 -x sh -c 'echo "--- $1"; rg -n "actions/checkout|persist-credentials|permissions|GITHUB_TOKEN|git " "$1" || true' sh {}

Repository: GetStream/react-native-webrtc

Length of output: 382

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== ios_ci.yml with awk line numbers =="
awk '{printf "%6d  %s\n", NR, $0}' .github/workflows/ios_ci.yml | sed -n '1,240p'

echo
echo "== relevant permissions and checkout usage across workflows =="
python3 - <<'PY'
from pathlib import Path
for p in Path('.github/workflows').glob('*.yml'):
    print(f"--- {p} ---")
    for i, line in enumerate(p.read_text().splitlines(), 1):
        if any(k in line for k in ['permissions:', 'actions/checkout', 'persist-credentials', 'GITHUB_TOKEN', 'git ']):
            print(f"{i}: {line}")
PY

Repository: GetStream/react-native-webrtc

Length of output: 2912

Disable checkout credential persistence for this build job.

This job only needs read access to check out the repository, but it then runs repository-controlled npm install, pod install, and Xcode build commands. The default persisted checkout token would unnecessarily remain available to those later steps; set persist-credentials: false unless a later step requires authenticated Git operations.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 20-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ios_ci.yml at line 20, Update the actions/checkout step in
the iOS build job to set persist-credentials to false, ensuring the checkout
token is not retained for subsequent npm, CocoaPods, or Xcode commands. Do not
add authenticated Git operations or other workflow changes.

Source: Linters/SAST tools

- uses: ./.github/actions/setup-node

- name: Get Xcode version
id: xcode
Expand All @@ -39,9 +34,6 @@ jobs:
restore-keys: |
${{ runner.os }}-xcode-${{ steps.xcode.outputs.version }}-pods-

- name: Install node modules
run: npm install

- name: Install example node modules
working-directory: ./examples/GumTestApp/
run: npm install
Expand Down
42 changes: 42 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
name: Release
on:
workflow_dispatch:
inputs:
dry_run:
description: Run release in "dry run" mode (does not publish)
default: false
type: boolean

permissions:
id-token: write # Required for npm Trusted Publishing (OIDC) + provenance
contents: write # Required to push the changelog/version commit + create the GH Release
issues: write # @semantic-release/github comments on / labels released issues
pull-requests: write # ...and on released pull requests

# Never cancel a release in flight: semantic-release pushes the tag and release
# commit before it publishes, so a cancelled run can leave the repo tagged with
# nothing on npm. Queue instead.
concurrency:
group: release-${{ github.ref }}
cancel-in-progress: false

jobs:
package_release:
name: Release from "${{ github.ref_name }}" branch
runs-on: ubuntu-latest
# GH does not allow limiting branches in workflow_dispatch settings, so guard here.
if: ${{ inputs.dry_run || github.ref_name == 'master' || github.ref_name == 'beta' || github.ref_name == 'alpha' || startsWith(github.ref_name, 'release') || endsWith(github.ref_name, '.x') }}
steps:
- name: Checkout
uses: actions/checkout@v6
with:
fetch-depth: 0 # full history + tags required by semantic-release

- uses: ./.github/actions/setup-node

- name: Release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: >
npx semantic-release
${{ inputs.dry_run && '--dry-run' || '' }}
34 changes: 34 additions & 0 deletions .releaserc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
{
"branches": [
"+([0-9])?(.{+([0-9]),x}).x",
"master",
{ "name": "beta", "prerelease": true },
{ "name": "alpha", "prerelease": true }
],
"plugins": [
[
"@semantic-release/commit-analyzer",
{
"preset": "conventionalcommits",
"releaseRules": [
{ "type": "refactor", "release": "patch" },
{ "scope": "deps", "release": "patch" }
]
Comment on lines +13 to +16

@coderabbitai coderabbitai Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

The deps scope rule may override type-based versioning.

Line 14 matches any commit with scope deps regardless of type. This means feat(deps): add feature would trigger a patch release instead of minor, potentially violating semver expectations. Consider adding a type constraint or documenting this intentional override.

📝 Alternative configuration if type-based versioning should be preserved 
         "releaseRules": [
           { "type": "refactor", "release": "patch" },
-          { "scope": "deps", "release": "patch" }
+          { "type": "chore", "scope": "deps", "release": "patch" }
         ]

Or document the current behavior if intentional.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"releaseRules": [
{ "type": "refactor", "release": "patch" },
{ "scope": "deps", "release": "patch" }
]
"releaseRules": [
{ "type": "refactor", "release": "patch" },
{ "type": "chore", "scope": "deps", "release": "patch" }
]
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.releaserc.json around lines 12 - 15, The releaseRules entry for scope
"deps" currently overrides type-based versioning (so commits like feat(deps):
... would be downgraded to patch); update the releaseRules array to either
narrow the rule by adding an explicit "type" constraint (for example add
"type":"chore" alongside "scope":"deps" and "release":"patch") or remove/replace
the scope-only rule and add a comment/documentation explaining the intended
behavior; target the "releaseRules" array and the rule object with
"scope":"deps" when making this change.

}
],
[
"@semantic-release/release-notes-generator",
{ "preset": "conventionalcommits" }
],
["@semantic-release/changelog", { "changelogFile": "CHANGELOG.md" }],
"@semantic-release/npm",
[
"@semantic-release/git",
{
"assets": ["CHANGELOG.md", "package.json", "package-lock.json"],
"message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
}
],
"@semantic-release/github"
]
}
86 changes: 33 additions & 53 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,58 +2,19 @@

# React-Native-WebRTC

[![npm version](https://img.shields.io/npm/v/react-native-webrtc)](https://www.npmjs.com/package/react-native-webrtc)
[![npm downloads](https://img.shields.io/npm/dm/react-native-webrtc)](https://www.npmjs.com/package/react-native-webrtc)
[![Discourse topics](https://img.shields.io/discourse/topics?server=https%3A%2F%2Freact-native-webrtc.discourse.group%2F)](https://react-native-webrtc.discourse.group/)
[![npm version](https://img.shields.io/npm/v/@stream-io/react-native-webrtc)](https://www.npmjs.com/package/@stream-io/react-native-webrtc)
[![npm downloads](https://img.shields.io/npm/dm/@stream-io/react-native-webrtc)](https://www.npmjs.com/package/@stream-io/react-native-webrtc)

A WebRTC module for React Native.

## Feature Overview

| | Android | iOS | tvOS | macOS* | Windows* | Web* | Expo* |
| :- | :-: | :-: | :-: | :-: | :-: | :-: | :-: |
| Audio/Video | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - | :heavy_check_mark: | :heavy_check_mark: |
| Data Channels | :heavy_check_mark: | :heavy_check_mark: | - | - | - | :heavy_check_mark: | :heavy_check_mark: |
| Screen Capture | :heavy_check_mark: | :heavy_check_mark: | - | - | - | :heavy_check_mark: | :heavy_check_mark: |
| Plan B | - | - | - | - | - | - | - |
| Unified Plan* | :heavy_check_mark: | :heavy_check_mark: | - | - | - | :heavy_check_mark: | :heavy_check_mark: |
| Simulcast* | :heavy_check_mark: | :heavy_check_mark: | - | - | - | :heavy_check_mark: | :heavy_check_mark: |

> **macOS** - We don't currently actively support macOS at this time.
Support might return in the future.

> **Windows** - We don't currently support the [react-native-windows](https://github.com/microsoft/react-native-windows) platform at this time.
Anyone interested in getting the ball rolling? We're open to contributions.

> **Web** - The [react-native-webrtc-web-shim](https://github.com/react-native-webrtc/react-native-webrtc-web-shim) project provides a shim for [react-native-web](https://github.com/necolas/react-native-web) support.
Which will allow you to use [(almost)](https://github.com/react-native-webrtc/react-native-webrtc-web-shim/tree/main#setup) the exact same code in your [react-native-web](https://github.com/necolas/react-native-web) project as you would with [react-native](https://reactnative.dev/) directly.

> **Expo** - As this module includes native code it is not available in the [Expo Go](https://expo.dev/client) app by default.
However you can get things working via the [expo-dev-client](https://docs.expo.dev/development/getting-started/) library and out-of-tree [config-plugins/react-native-webrtc](https://github.com/expo/config-plugins/tree/master/packages/react-native-webrtc) package.

> **Unified Plan** - As of version 106.0.0 Unified Plan is the only supported mode.
Those still in need of Plan B will need to use an older release.

> **Simulcast** - As of version 111.0.0 Simulcast is now possible with ease.
Software encode/decode factories have been enabled by default.

## WebRTC Revision

* Currently used revision: [M124](https://github.com/jitsi/webrtc/tree/M124)
* Supported architectures
* Android: armeabi-v7a, arm64-v8a, x86, x86_64
* iOS: arm64, x86_64
* tvOS: arm64
* macOS: arm64, x86_64
A WebRTC module for React Native tailored for the [`@stream-io/video-react-native-sdk`](https://github.com/GetStream/stream-video-js) needs.

## Getting Started

Use one of the following preferred package install methods to immediately get going.
Don't forget to follow platform guides below to cover any extra required steps.
Don't forget to follow platform guides below to cover any extra required steps.

**npm:** `npm install react-native-webrtc --save`
**yarn:** `yarn add react-native-webrtc`
**pnpm:** `pnpm install react-native-webrtc`
**npm:** `npm install @stream-io/react-native-webrtc --save`
**yarn:** `yarn add @stream-io/react-native-webrtc`
**pnpm:** `pnpm install @stream-io/react-native-webrtc`

## Guides

Expand All @@ -68,18 +29,37 @@ Don't forget to follow platform guides below to cover any extra required steps.
## Example Projects

We have some very basic example projects included in the [examples](./examples) directory.
Don't worry, there are plans to include a much more broader example with backend included.
Don't worry, there are plans to include a much more broader example with backend included.

@coderabbitai coderabbitai Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix grammatical error: "much more broader" is incorrect.

The phrase "much more broader" uses a double comparative, which is grammatically incorrect. It should be either "much broader" or "a more comprehensive".

📝 Proposed fix 
-Don't worry, there are plans to include a much more broader example with backend included.
+Don't worry, there are plans to include a much broader example with backend included.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
Don't worry, there are plans to include a much more broader example with backend included.
Don't worry, there are plans to include a much broader example with backend included.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` at line 32, The README contains the incorrect phrase "much more
broader"; update that sentence to use a correct comparative such as "much
broader" or "a more comprehensive example with backend included" to remove the
double comparative. Locate the sentence in README.md and replace "much more
broader example with backend included" with one of the suggested alternatives so
the grammar is corrected.


## Releasing

Releases are automated with [semantic-release](https://semantic-release.gitbook.io/) via the
[`Release`](./.github/workflows/release.yml) workflow, which is triggered manually from the
Actions tab (**Run workflow**).

There is no channel input — **the branch you dispatch from selects the release channel**, using
the *"Use workflow from"* branch dropdown:

## Community
| Dispatch from | Version | npm dist-tag |
| :- | :- | :- |
| `master` | `145.1.0` | `latest` |
| `beta` | `145.1.0-beta.1` | `beta` |
| `alpha` | `145.1.0-alpha.1` | `alpha` |
| `<major>.x` (e.g. `145.x`) | `145.0.1` | `145.x` |

Come join our [Discourse Community](https://react-native-webrtc.discourse.group/) if you want to discuss any React Native and WebRTC related topics.
Everyone is welcome and every little helps.
A branch only appears in the dropdown once it exists on the remote and contains the workflow
file, so `alpha`/`beta`/`<major>.x` need to be branched off `master` before their first use.

## Picture-in-Picture (PIP)
Tick **`dry_run`** to run `semantic-release --dry-run`: it computes the next version and prints
the release notes without publishing, tagging, or pushing.

This package does not include a built-in PIP implementation. PIP support is available via [`@stream-io/video-react-native-sdk`](https://github.com/GetStream/stream-video-js).
The version is derived from the [Conventional Commits](https://www.conventionalcommits.org/)
since the last tag — never by hand-editing `package.json`. `feat:` yields a minor, `fix:` a
patch, and `refactor:` and any `deps`-scoped commit also yield a patch. Publishing uses npm
[Trusted Publishing](https://docs.npmjs.com/trusted-publishers) (OIDC), so no npm token is
involved.

## Related Projects

Looking for extra functionality coverage?
The [react-native-webrtc](https://github.com/react-native-webrtc) organization provides a number of packages which are more than useful when developing Real Time Communication applications.
The [react-native-webrtc](https://github.com/react-native-webrtc) organization provides a number of packages which are more than useful when developing Real Time Communication applications.

@coderabbitai coderabbitai Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add hyphen to compound adjective "Real Time Communication".

When "Real Time" modifies "Communication" as a compound adjective, it should be hyphenated as "Real-Time Communication" for correct English grammar.

📝 Proposed fix 
-The [react-native-webrtc](https://github.com/react-native-webrtc) organization provides a number of packages which are more than useful when developing Real Time Communication applications.
+The [react-native-webrtc](https://github.com/react-native-webrtc) organization provides a number of packages which are more than useful when developing Real-Time Communication applications.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
The [react-native-webrtc](https://github.com/react-native-webrtc) organization provides a number of packages which are more than useful when developing Real Time Communication applications.
The [react-native-webrtc](https://github.com/react-native-webrtc) organization provides a number of packages which are more than useful when developing Real-Time Communication applications.
🧰 Tools
🪛 LanguageTool

[uncategorized] ~37-~37: If this is a compound adjective that modifies the following noun, use a hyphen.
Context: ...ch are more than useful when developing Real Time Communication applications.

(EN_COMPOUND_ADJECTIVE_INTERNAL)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` at line 37, Update the phrase "Real Time Communication" in
README.md to the hyphenated compound adjective "Real‑Time Communication"
wherever it modifies "Communication" (e.g., the sentence containing "provides a
number of packages which are more than useful when developing Real Time
Communication applications"); replace the unhyphenated occurrence with
"Real-Time Communication" to correct grammar.

Source: Linters/SAST tools

Loading
Loading