ci: adopt mint for versioning + release provenance - #30
Merged
Conversation
Wire door-kit to mint so future releases are cut in CI from a per-PR intent (deterministic version + changelog + tag) instead of a hand-pushed tag matched to jsr.json by eye. No intent yet — this is the tooling only; the next user-facing change (the scout-wire 0.3.0 client) drops the first intent. - .release/README.md — the intent-drop convention. - version.yml — `mint plan` validates intents + previews the next version on every PR (mint reusable @v0.3.1). - release.yml — on a v* tag, mint in-toto release-provenance + cosign keyless signing (reusable @v0.3.1). - publish.yml (unchanged) still does the JSR publish on the tag via OIDC. Note: package.json (0.6.0) and jsr.json (0.11.0) currently disagree; mint reads jsr.json first and, on the next `mint version`, sets BOTH manifests to the same computed version — reconciling the drift at the next release. Verified locally: `mint plan` → no intents, stays 0.11.0 (green, nothing to release yet). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H7i26MiqwkD1gCRAY85gJY
A workflow_dispatch job that runs mint version + commit + mint release entirely in CI, so a release tag is only ever cut by mint from the Actions UI. No-op without intents; requires the workflow may push to main. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H7i26MiqwkD1gCRAY85gJY
v0.3.1 predates mint's deno.json support (landed in 0.5.0), so `mint plan` crashed with ENOENT on package.json for deno.json-only repos. Pin the version/release/cut-release workflows to v0.5.0, which reads + bumps deno.json / jsr.json / package.json. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H7i26MiqwkD1gCRAY85gJY
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Wire door-kit to mint so releases are
cut in CI from a per-PR intent — deterministic version + changelog + provenance —
instead of a hand-pushed
v*tag matched tojsr.jsonby eye. Same pattern asverbspec-mcpand the scout-wire adoption.Tooling only — no intent yet. door-kit's next user-facing change (the
scout-wire 0.3.0 client wrappers) will drop the first
.release/intent; this PRjust puts the rails in place.
Changes
.release/README.md— the intent-drop convention.version.yml—mint planvalidates intents + previews the next version oneach PR (mint reusable
@v0.3.1).release.yml— on av*tag, mint in-toto release-provenance + cosignkeyless signing (reusable
@v0.3.1).publish.yml(unchanged) still does the JSR publish on the tag via OIDC.Note on the version drift
package.json(0.6.0) andjsr.json(0.11.0) currently disagree. mint readsjsr.jsonfirst and, on the nextmint version, sets both manifests to thesame computed version — so the drift reconciles at the next release rather than
in this infra PR.
Verification
mint planrun locally against this branch: "no intents — nothing to release(stays 0.11.0)" — green, as expected for a tooling-only change.
bun test(standard.yml) and
publish.yml's dry-run are unaffected.🤖 Generated with Claude Code
https://claude.ai/code/session_01H7i26MiqwkD1gCRAY85gJY
Generated by Claude Code
Need help on this PR? Tag
/codesmithwith what you need. Autofix is disabled.