ci: stage v2 npm releases under the v2-legacy dist-tag

.changeset/config.json

@@ -1,17 +1,15 @@
 {
   "$schema": "https://unpkg.com/@changesets/config@1.4.0/schema.json",
   "changelog": [
-    "@changesets/cli/changelog",
-    { "repo": "0xsequence/sequence.js" }
+    "@changesets/changelog-github",
+    {
+      "repo": "0xsequence/sequence.js"
+    }
   ],
   "commit": false,
-  "linked": [
-    [
-      "@0xsequence/*"
-    ]
-  ],
+  "linked": [["@0xsequence/*"]],
   "access": "public",
-  "baseBranch": "master",
+  "baseBranch": "v2",
   "ignore": [],
   "___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH": {
     "updateInternalDependents": "always"

.changeset/dry-jeans-lie.md

@@ -0,0 +1,2 @@
+---
+---

.github/workflows/changeset-check-trigger.yml

@@ -0,0 +1,13 @@
+name: Changeset check
+
+on:
+  pull_request:
+    branches: [v2]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  check:
+    uses: 0xPolygon/pipelines/.github/workflows/apps-changeset-check.yml@main

.github/workflows/npm-release-trigger.yml

@@ -0,0 +1,126 @@
+name: Release
+
+# Staged npm publishing for v2 via changesets + OIDC trusted publishing. See PUBLISHING.md.
+# master has its own copy of this file (same name, so the same npm trusted publisher applies).
+# v2 releases stage under the `v2-legacy` dist-tag so they never move `latest`, which is v3.
+
+on:
+  push:
+    branches: [v2]
+  workflow_dispatch:
+    inputs:
+      snapshot_tag:
+        description: 'npm dist-tag for snapshot (e.g. v2-canary). Non-semver values only.'
+        required: true
+        default: 'v2-snapshot'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+# Default-deny: each job declares its own permissions.
+permissions: {}
+
+jobs:
+  release:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write # required for npm OIDC trusted publishing
+    steps:
+      # Nothing pushes over git (changesets github-api mode writes through the API with the
+      # app token below), so do not persist the read-only job token into .git/config.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+          registry-url: 'https://registry.npmjs.org'
+      - name: Install npm with staged-publishing support
+        run: npm install --global npm@11.15.0
+      # The release PR changes package manifests without regenerating the lockfile. Link
+      # co-released workspace packages locally so the not-yet-public versions still install.
+      # --ignore-scripts: releasing needs no install-time script, and this job holds id-token: write.
+      - run: pnpm install --no-frozen-lockfile --config.link-workspace-packages=true --ignore-scripts
+      # postinstall (preconstruct dev) is skipped by --ignore-scripts; changeset:version needs its links.
+      - run: pnpm dev
+      - name: Detect release PR merge
+        id: pending
+        run: |
+          if find .changeset -name '*.md' ! -name README.md | grep -q .; then
+            echo "changesets=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changesets=false" >> "$GITHUB_OUTPUT"
+          fi
+      # Only a merged release PR (no pending changesets) stages packages. Run the gates before
+      # the release bot token exists so build and test code never sees it.
+      - name: Release gates
+        if: steps.pending.outputs.changesets == 'false'
+        run: pnpm run ci:release-gates
+      # Mint the app token last, scoped to what changesets/action uses, so only that step has it.
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: ${{ secrets.CHANGESET_RELEASE_BOT_APP_ID }}
+          private-key: ${{ secrets.CHANGESET_RELEASE_BOT_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+      - name: Create release PR or stage versioned packages
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        with:
+          title: 'changesets: Release / Deploy (v2)'
+          commit: 'release: version packages'
+          commitMode: github-api
+          # Also bumps the embedded version constant and the network names doc.
+          version: pnpm changeset:version
+          # When a merged release PR has consumed all changesets, this command packs with
+          # pnpm (rewriting workspace: ranges) and stages the tarballs with npm. Its
+          # `New tag:` output lets the action create package tags and GitHub Releases.
+          publish: pnpm run ci:stage-release
+          createGithubReleases: true
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          NPM_STAGE_TAG: v2-legacy
+
+  snapshot:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      pull-requests: read # changelog-github PR lookups
+      id-token: write # required for npm OIDC trusted publishing
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+          registry-url: 'https://registry.npmjs.org'
+      - name: Install npm with staged-publishing support
+        run: npm install --global npm@11.15.0
+      - run: pnpm install --no-frozen-lockfile --config.link-workspace-packages=true --ignore-scripts
+      # postinstall (preconstruct dev) is skipped by --ignore-scripts; changeset:version needs its links.
+      - run: pnpm dev
+      - name: Version snapshot
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          SNAPSHOT_TAG: ${{ inputs.snapshot_tag }}
+        run: node scripts/prepare-npm-snapshot.mjs
+      - name: Release gates
+        run: pnpm run ci:release-gates
+      - name: Stage snapshot packages
+        env:
+          NPM_STAGE_CREATE_GIT_TAGS: 'false'
+          NPM_STAGE_TAG: ${{ inputs.snapshot_tag }}
+        run: pnpm run ci:stage-release

.nvmrc

@@ -0,0 +1 @@
+22

PUBLISHING.md

@@ -0,0 +1,26 @@
+# Publishing (v2)
+
+> **Publishing is CI-only. Never publish or stage from a local machine.** Do not run `changeset:version`,
+> `changeset:publish`, `npm publish`, `npm stage publish`, or the internal `ci:stage-release` script yourself.
+
+v2 uses the same staged publishing flow as `master`; see `PUBLISHING.md` on `master` for the full description,
+approval steps, failure recovery, and one-time setup. The differences on this branch:
+
+- **Dist-tag:** releases stage under **`v2-legacy`**, never `latest` (which belongs to v3). Install v2 with
+  `pnpm add @0xsequence/<package>@v2-legacy`.
+- **Trigger:** merging changesets into `v2` opens a `changesets: Release / Deploy (v2)` PR; merging that PR stages
+  the packages. Versioning runs `pnpm changeset:version`, which also updates the embedded version constant and the
+  network names doc.
+- **Release gates:** build (which includes typecheck), lint, and the release script tests, run before the release bot
+  token is minted. The per-package test matrix in
+  `tests.yml` already runs on every push to `v2`, including the release PR merge.
+- **Linked versions:** all `@0xsequence/*` packages are `linked`, so a release stages every package at one version.
+
+## Day-to-day: add a changeset
+
+```bash
+pnpm changeset
+```
+
+The `Changeset check` CI job fails a PR into `v2` that touches a package without one
+(`pnpm changeset add --empty` for changes with no consumer impact).

package.json

@@ -24,7 +24,10 @@
     "dev": "preconstruct dev",
     "postinstall": "preconstruct dev",
     "coverage": "rimraf ./coverage && rimraf ./.nyc_output && nyc pnpm test",
-    "prepare": "husky install"
+    "prepare": "husky install",
+    "test:release": "node --test scripts/*.test.mjs",
+    "ci:stage-release": "node scripts/stage-npm-packages.mjs",
+    "ci:release-gates": "pnpm build && pnpm lint && pnpm test:release"
   },
   "husky": {
     "hooks": {
@@ -78,6 +81,7 @@
     "prettier": "^3.0.0",
     "puppeteer": "^23.10.3",
     "rimraf": "^6.0.1",
+    "semver": "^7.7.2",
     "ts-node": "^10.9.2",
     "tsx": "^4.19.1",
     "typescript": "~5.6.3",

packages/0xsequence/package.json

@@ -2,7 +2,11 @@
   "name": "0xsequence",
   "version": "2.3.47",
   "description": "Sequence: a modular web3 stack and smart wallet for Ethereum chains",
-  "repository": "https://github.com/0xsequence/sequence.js",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/0xsequence"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence.cjs.js",
   "module": "dist/0xsequence.esm.js",

packages/abi/package.json

@@ -2,7 +2,11 @@
   "name": "@0xsequence/abi",
   "version": "2.3.47",
   "description": "abi sub-package for Sequence",
-  "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/abi",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/abi"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence-abi.cjs.js",
   "module": "dist/0xsequence-abi.esm.js",

packages/account/package.json

@@ -2,7 +2,11 @@
   "name": "@0xsequence/account",
   "version": "2.3.47",
   "description": "tools for migrating sequence wallets to new versions",
-  "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/account",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/account"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence-account.cjs.js",
   "module": "dist/0xsequence-account.esm.js",

packages/api/package.json

@@ -2,7 +2,11 @@
   "name": "@0xsequence/api",
   "version": "2.3.47",
   "description": "api sub-package for Sequence",
-  "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/api",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/api"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence-api.cjs.js",
   "module": "dist/0xsequence-api.esm.js",

packages/auth/package.json

@@ -2,7 +2,11 @@
   "name": "@0xsequence/auth",
   "version": "2.3.47",
   "description": "auth sub-package for Sequence",
-  "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/auth",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/auth"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence-auth.cjs.js",
   "module": "dist/0xsequence-auth.esm.js",

packages/builder/package.json

@@ -2,7 +2,11 @@
   "name": "@0xsequence/builder",
   "version": "2.3.47",
   "description": "builder sub-package for Sequence",
-  "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/builder",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/builder"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence-builder.cjs.js",
   "module": "dist/0xsequence-builder.esm.js",

packages/core/package.json

@@ -2,7 +2,11 @@
   "name": "@0xsequence/core",
   "version": "2.3.47",
   "description": "core primitives for interacting with the sequence wallet contracts",
-  "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/core",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/core"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence-core.cjs.js",
   "module": "dist/0xsequence-core.esm.js",

packages/deployer/package.json

@@ -2,7 +2,11 @@
   "name": "@0xsequence/deployer",
   "version": "2.3.47",
   "description": "deployer sub-package for Sequence",
-  "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/deployer",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/deployer"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence-deployer.cjs.js",
   "module": "dist/0xsequence-deployer.esm.js",

packages/guard/package.json

@@ -2,7 +2,11 @@
   "name": "@0xsequence/guard",
   "version": "2.3.47",
   "description": "guard sub-package for Sequence",
-  "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/guard",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/guard"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence-guard.cjs.js",
   "module": "dist/0xsequence-guard.esm.js",

packages/indexer/package.json

@@ -2,7 +2,11 @@
   "name": "@0xsequence/indexer",
   "version": "2.3.47",
   "description": "indexer sub-package for Sequence",
-  "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/indexer",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/indexer"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence-indexer.cjs.js",
   "module": "dist/0xsequence-indexer.esm.js",

packages/marketplace/package.json

@@ -2,7 +2,11 @@
     "name": "@0xsequence/marketplace",
     "version": "2.3.47",
     "description": "marketplace sub-package for Sequence",
-    "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/marketplace",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/0xsequence/sequence.js.git",
+        "directory": "packages/marketplace"
+    },
     "source": "src/index.ts",
     "main": "dist/0xsequence-marketplace.cjs.js",
     "module": "dist/0xsequence-marketplace.esm.js",

packages/metadata/package.json

@@ -2,7 +2,11 @@
   "name": "@0xsequence/metadata",
   "version": "2.3.47",
   "description": "metadata sub-package for Sequence",
-  "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/metadata",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/metadata"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence-metadata.cjs.js",
   "module": "dist/0xsequence-metadata.esm.js",

packages/migration/package.json

@@ -2,7 +2,11 @@
   "name": "@0xsequence/migration",
   "version": "2.3.47",
   "description": "tools for migrating sequence wallets to new versions",
-  "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/migration",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/migration"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence-migration.cjs.js",
   "module": "dist/0xsequence-migration.esm.js",

packages/network/package.json

@@ -2,7 +2,11 @@
   "name": "@0xsequence/network",
   "version": "2.3.47",
   "description": "network sub-package for Sequence",
-  "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/network",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsequence/sequence.js.git",
+    "directory": "packages/network"
+  },
   "source": "src/index.ts",
   "main": "dist/0xsequence-network.cjs.js",
   "module": "dist/0xsequence-network.esm.js",