chore(release): protect latest release channels from v16 (#4826)

Author: yaacovCR

.github/CONTRIBUTING.md

@@ -85,6 +85,11 @@ export GH_TOKEN=<token> # required to build changelog via GitHub API requests
 npm run release:prepare -- 16.x.x patch
 ```
 
+Stable `16.x.x` releases publish to npm with the `latest-16` tag so they do
+not replace the package `latest` tag, and their GitHub releases are explicitly
+not marked as the latest release. Users can install this line with a semver
+specifier, for example `npm install graphql@16`.
+
 Push `<my_release_branch>`, open a PR from `<my_release_branch>` to `16.x.x`,
 wait for CI to pass, merge the PR, and then approve the GitHub Actions release
 workflow.

.github/workflows/release.yml

@@ -14,6 +14,7 @@ jobs:
       should_publish: ${{ steps.release_metadata.outputs.should_publish }}
       tag: ${{ steps.release_metadata.outputs.tag }}
       dist_tag: ${{ steps.release_metadata.outputs.dist_tag }}
+      latest: ${{ steps.release_metadata.outputs.latest }}
       prerelease: ${{ steps.release_metadata.outputs.prerelease }}
       tarball_name: ${{ steps.release_metadata.outputs.tarball_name }}
     concurrency:
@@ -48,6 +49,7 @@ jobs:
             "version=\(.version)",
             "tag=\(.tag)",
             "dist_tag=\(.distTag)",
+            "latest=\(.latest)",
             "prerelease=\(.prerelease)",
             "package_spec=\(.packageSpec)",
             "tarball_name=\(.tarballName)",
@@ -111,11 +113,7 @@ jobs:
 
       - name: Publish npm package
         run: |
-          if [ -n "${{ needs.check-publish.outputs.dist_tag }}" ]; then
-            npm publish --provenance --tag "${{ needs.check-publish.outputs.dist_tag }}" "./artifacts/${{ needs.check-publish.outputs.tarball_name }}"
-          else
-            npm publish --provenance "./artifacts/${{ needs.check-publish.outputs.tarball_name }}"
-          fi
+          npm publish --provenance --tag "${{ needs.check-publish.outputs.dist_tag }}" "./artifacts/${{ needs.check-publish.outputs.tarball_name }}"
 
   create-release:
     name: Create release
@@ -169,8 +167,14 @@ jobs:
               --notes-file "${release_notes_file}" \
               --prerelease
           else
+            latest_flag="--latest=false"
+            if [ "${{ needs.check-publish.outputs.latest }}" = "true" ]; then
+              latest_flag="--latest"
+            fi
+
             gh release create "${tag}" \
               --verify-tag \
               --title "${tag}" \
-              --notes-file "${release_notes_file}"
+              --notes-file "${release_notes_file}" \
+              "${latest_flag}"
           fi

package.json

@@ -73,8 +73,5 @@
     "mocha": "9.2.2",
     "prettier": "2.6.2",
     "typescript": "4.6.3"
-  },
-  "publishConfig": {
-    "tag": "latest"
   }
 }

resources/build-npm.js

@@ -107,33 +107,11 @@ function buildPackageJSON() {
   delete packageJSON.scripts;
   delete packageJSON.devDependencies;
 
-  // TODO: move to integration tests
-  const publishTag = packageJSON.publishConfig?.tag;
-  assert(publishTag != null, 'Should have packageJSON.publishConfig defined!');
-
   const { version } = packageJSON;
   const versionMatch = /^\d+\.\d+\.\d+-?(?<preReleaseTag>.*)?$/.exec(version);
   if (!versionMatch) {
     throw new Error('Version does not match semver spec: ' + version);
   }
 
-  const { preReleaseTag } = versionMatch.groups;
-
-  if (preReleaseTag != null) {
-    const splittedTag = preReleaseTag.split('.');
-    // Note: `experimental-*` take precedence over `alpha`, `beta` or `rc`.
-    const versionTag = splittedTag[2] ?? splittedTag[0];
-    assert(
-      ['alpha', 'beta', 'rc'].includes(versionTag) ||
-        versionTag.startsWith('experimental-'),
-      `"${versionTag}" tag is not supported.`,
-    );
-    assert.equal(
-      versionTag,
-      publishTag,
-      'Publish tag and version tag should match!',
-    );
-  }
-
   return packageJSON;
 }

resources/release-metadata.js

@@ -1,22 +1,31 @@
 'use strict';
 
 const {
+  getReleaseDistTag,
+  isLatestReleaseVersion,
+  isPrereleaseVersion,
   readPackageJSON,
   readPackageJSONAtRef,
   spawnOutput,
 } = require('./utils.js');
 
 try {
   const packageJSON = readPackageJSON();
-  const { version, publishConfig } = packageJSON;
+  const { version } = packageJSON;
 
   if (typeof version !== 'string' || version === '') {
     throw new Error('package.json is missing a valid "version" field.');
   }
 
   const tag = `v${version}`;
-  const distTag = publishConfig?.tag ?? '';
-  const prerelease = distTag === 'alpha';
+  const latestVersion = spawnOutput('npm', [
+    'view',
+    'graphql',
+    'dist-tags.latest',
+  ]);
+  const distTag = getReleaseDistTag(version, latestVersion);
+  const latest = isLatestReleaseVersion(version, latestVersion);
+  const prerelease = isPrereleaseVersion(version);
   const releaseCommitSha = findReleaseCommitSha(version);
   const releaseNotes =
     releaseCommitSha == null
@@ -45,6 +54,7 @@ try {
     version,
     tag,
     distTag,
+    latest,
     prerelease,
     releaseNotes,
     packageSpec,

resources/utils.js

@@ -137,6 +137,48 @@ function readPackageJSONAtRef(ref) {
   return JSON.parse(packageJSONAtRef);
 }
 
+function getReleaseDistTag(version, latestVersion) {
+  const { major, prerelease } = parseSemVer(version);
+  if (prerelease != null) {
+    return getPrereleaseDistTag(prerelease);
+  }
+
+  return major >= parseSemVer(latestVersion).major
+    ? 'latest'
+    : `latest-${major}`;
+}
+
+function isLatestReleaseVersion(version, latestVersion) {
+  const { major, prerelease } = parseSemVer(version);
+  return prerelease == null && major >= parseSemVer(latestVersion).major;
+}
+
+function isPrereleaseVersion(version) {
+  return parseSemVer(version).prerelease != null;
+}
+
+function parseSemVer(version) {
+  const versionMatch =
+    /^(?<major>\d+)\.\d+\.\d+(?:-(?<prerelease>[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(
+      version,
+    );
+  if (versionMatch?.groups == null) {
+    throw new Error('Version does not match semver spec: ' + version);
+  }
+
+  const { major, prerelease } = versionMatch.groups;
+  return {
+    major: Number(major),
+    prerelease: prerelease ?? null,
+  };
+}
+
+function getPrereleaseDistTag(prerelease) {
+  const splittedTag = prerelease.split('.');
+  // Note: `experimental-*` take precedence over `alpha`, `beta` or `rc`.
+  return splittedTag[2] ?? splittedTag[0];
+}
+
 function tagExists(tag) {
   const result = childProcess.spawnSync(
     'git',
@@ -148,6 +190,9 @@ function tagExists(tag) {
 
 module.exports = {
   exec,
+  getReleaseDistTag,
+  isLatestReleaseVersion,
+  isPrereleaseVersion,
   spawn,
   spawnOutput,
   readdirRecursive,