From bac2b96f84cbad50e3fb765b2f0e481d0a217e17 Mon Sep 17 00:00:00 2001 From: Ian Clanton-Thuon Date: Tue, 15 Sep 2026 20:50:24 -0400 Subject: [PATCH 1/4] Add `--publish` flag to `rush publish` command to prevent a dry-run. --- common/config/azure-pipelines/templates/bump-versions.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/common/config/azure-pipelines/templates/bump-versions.yaml b/common/config/azure-pipelines/templates/bump-versions.yaml index f8dd6efc..8d5b0d6e 100644 --- a/common/config/azure-pipelines/templates/bump-versions.yaml +++ b/common/config/azure-pipelines/templates/bump-versions.yaml @@ -23,6 +23,7 @@ steps: node common/scripts/install-run-rush.js publish --apply --pack + --publish --include-all --release-folder $(Build.ArtifactStagingDirectory)/packages displayName: 'Rush Publish (apply version bumps and pack)' From 40c5d46f32bacf49906881e72d1aaf5a822fdf5e Mon Sep 17 00:00:00 2001 From: Ian Clanton-Thuon Date: Tue, 15 Sep 2026 20:59:20 -0400 Subject: [PATCH 2/4] Bump versions with a separate "rush version --bump" step "rush publish --apply --pack --include-all" does not apply version bumps: "--include-all" routes to Rush's "publish all" code path, which packs every project at its current package.json version and never calls changeManager.apply, so the change files were ignored and nothing was bumped. Adding "--publish" does not help, since the "--pack" path only uses that flag for git tagging. Split the flow into two explicit steps, matching how the rushstack repo bumps and packs separately: - bump-versions.yaml now runs "rush version --bump", which applies the change files (bumps package.json versions, regenerates CHANGELOGs, updates inter-project ranges, deletes consumed change files). "--target-branch" is omitted, so Rush performs no git operations of its own (every PublishGit operation is gated on a target branch); the bumps land in the working tree and we commit them onto the feature branch. - New pack.yaml runs "rush publish --pack --include-all" to pack the bumped packages into tarballs for the ESRP publish pipeline. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d79bf579-32e9-40b3-91b0-98e008c81849 --- .../config/azure-pipelines/npm-publish.yaml | 2 + .../templates/bump-versions.yaml | 37 ++++++++----------- .../azure-pipelines/templates/pack.yaml | 23 ++++++++++++ 3 files changed, 40 insertions(+), 22 deletions(-) create mode 100644 common/config/azure-pipelines/templates/pack.yaml diff --git a/common/config/azure-pipelines/npm-publish.yaml b/common/config/azure-pipelines/npm-publish.yaml index f66e4459..62c30996 100644 --- a/common/config/azure-pipelines/npm-publish.yaml +++ b/common/config/azure-pipelines/npm-publish.yaml @@ -86,6 +86,8 @@ extends: - template: /common/config/azure-pipelines/templates/bump-versions.yaml@self + - template: /common/config/azure-pipelines/templates/pack.yaml@self + - template: /common/config/azure-pipelines/templates/post-publish.yaml@self - template: /common/config/azure-pipelines/templates/push-and-create-github-pr.yaml@self diff --git a/common/config/azure-pipelines/templates/bump-versions.yaml b/common/config/azure-pipelines/templates/bump-versions.yaml index 8d5b0d6e..47fdea14 100644 --- a/common/config/azure-pipelines/templates/bump-versions.yaml +++ b/common/config/azure-pipelines/templates/bump-versions.yaml @@ -1,38 +1,31 @@ -# Applies the pending "rush change" files to bump package versions and update CHANGELOGs, packs the -# resulting tarballs, and commits the version bump on the automated feature branch. Unlike the -# previous flow, this does NOT push to "main" (pushing directly to "main" is blocked) -- the commit -# is opened as a PR instead. +# Applies the pending "rush change" files to bump package versions and update CHANGELOGs, then +# commits the version bump on the automated feature branch. Packing the tarballs is a separate step +# (see pack.yaml); this template only bumps and commits. # -# Apply and pack are performed in a single "rush publish" invocation, while the change files are -# still present: "--apply" bumps package.json versions and regenerates CHANGELOG files, "--pack" -# writes an npm tarball per publishable project into the release folder, and "--include-all" ensures -# every "shouldPublish" project is packed. Rush requires "--include-all" whenever "--pack" is used, -# so every publishable project is packed regardless of whether its version changed in this bump. -# That is fine because ESRP ignores tarballs whose version is already published, so the unchanged -# packages are simply skipped at publish time. +# "rush version --bump" applies the change files: it bumps package.json versions, regenerates the +# CHANGELOG files, updates inter-project dependency ranges, and deletes the consumed change files. +# We deliberately omit "--target-branch": every git operation in Rush's PublishGit is gated on a +# target branch being set, so without it Rush performs NO git operations -- the bumps land in the +# working tree and we commit them ourselves onto the feature branch (which is later opened as a PR +# instead of pushed directly to "main"). # -# Because "--target-branch" is omitted, "rush publish" leaves the bumps uncommitted in the working -# tree, which lets us commit exactly those changes ourselves. +# Note: "rush publish --apply --include-all" does NOT bump versions -- "--include-all" routes to +# Rush's "publish all" path, which packs every project at its current version and never applies the +# change files. That is why version bumping must be done here with "rush version --bump". parameters: - name: RepoPath type: string default: '$(Agent.BuildDirectory)/tsdoc' steps: - - script: > - node common/scripts/install-run-rush.js publish - --apply - --pack - --publish - --include-all - --release-folder $(Build.ArtifactStagingDirectory)/packages - displayName: 'Rush Publish (apply version bumps and pack)' + - script: 'node common/scripts/install-run-rush.js version --bump' + displayName: 'Rush Version (apply version bumps)' workingDirectory: ${{ parameters.RepoPath }} - bash: | set -euo pipefail git add -u -- common/changes - git add -- '**/CHANGELOG.md' '**/CHANGELOG.json' '**/package.json' 'common/config/rush/version-policies.json' + git add -- '**/CHANGELOG.md' '**/CHANGELOG.json' '**/package.json' if [ -n "$(git diff --cached --numstat)" ]; then git commit -m "Applying package version bumps diff --git a/common/config/azure-pipelines/templates/pack.yaml b/common/config/azure-pipelines/templates/pack.yaml new file mode 100644 index 00000000..4af81fa2 --- /dev/null +++ b/common/config/azure-pipelines/templates/pack.yaml @@ -0,0 +1,23 @@ +# Packs every publishable ("shouldPublish") project into an npm tarball at its freshly bumped +# version, into the release folder that the bump pipeline uploads as the "packages" artifact. Runs +# only when the bump step actually produced version changes. +# +# Rush requires "--include-all" whenever "--pack" is used, so every publishable project is packed +# regardless of whether its version changed in this bump. "--include-all" packs projects directly +# from their (already bumped) package.json versions and does not depend on the change files, so it +# is safe to run after "rush version --bump" has consumed them. Packing unchanged projects is +# harmless because ESRP ignores tarballs whose version is already published. +parameters: + - name: RepoPath + type: string + default: '$(Agent.BuildDirectory)/tsdoc' + +steps: + - script: > + node common/scripts/install-run-rush.js publish + --pack + --include-all + --release-folder $(Build.ArtifactStagingDirectory)/packages + displayName: 'Rush Pack' + workingDirectory: ${{ parameters.RepoPath }} + condition: and(succeeded(), eq(variables.HasChanges, 'true')) From d57c428f46fafc466cf86bacfc342e05d46a0dd0 Mon Sep 17 00:00:00 2001 From: Ian Clanton-Thuon Date: Tue, 15 Sep 2026 21:00:56 -0400 Subject: [PATCH 3/4] Add --publish to the pack step so it produces tarballs Rush's pack step only runs "npm pack" and copies the tarball into the release folder when "--publish" is set (shouldExecute: this.#publish.value in PublishAction#npmPackAsync); without it the pack is a dry-run and produces no tarballs. With "--pack" set, "--publish" does not publish to the registry -- Rush takes the pack branch, not the npm-publish branch -- so ESRP still performs the real publish later. This matches the spfx repo's pack invocation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d79bf579-32e9-40b3-91b0-98e008c81849 --- common/config/azure-pipelines/templates/pack.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/common/config/azure-pipelines/templates/pack.yaml b/common/config/azure-pipelines/templates/pack.yaml index 4af81fa2..6425368f 100644 --- a/common/config/azure-pipelines/templates/pack.yaml +++ b/common/config/azure-pipelines/templates/pack.yaml @@ -7,6 +7,11 @@ # from their (already bumped) package.json versions and does not depend on the change files, so it # is safe to run after "rush version --bump" has consumed them. Packing unchanged projects is # harmless because ESRP ignores tarballs whose version is already published. +# +# "--publish" is required alongside "--pack": Rush's pack step only actually runs "npm pack" and +# copies the tarball into the release folder when "--publish" is set; without it the pack is a +# dry-run and produces no tarballs. With "--pack" set this does NOT publish to the registry (Rush +# takes the pack branch, never the npm-publish branch) -- ESRP performs the real publish later. parameters: - name: RepoPath type: string @@ -16,6 +21,7 @@ steps: - script: > node common/scripts/install-run-rush.js publish --pack + --publish --include-all --release-folder $(Build.ArtifactStagingDirectory)/packages displayName: 'Rush Pack' From 160cd156f7988011c6dfbbcc5e30557e4831e945 Mon Sep 17 00:00:00 2001 From: Ian Clanton-Thuon Date: Tue, 15 Sep 2026 21:01:20 -0400 Subject: [PATCH 4/4] fixup! Bump versions with a separate "rush version --bump" step --- common/config/azure-pipelines/templates/bump-versions.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/common/config/azure-pipelines/templates/bump-versions.yaml b/common/config/azure-pipelines/templates/bump-versions.yaml index 47fdea14..badade12 100644 --- a/common/config/azure-pipelines/templates/bump-versions.yaml +++ b/common/config/azure-pipelines/templates/bump-versions.yaml @@ -25,7 +25,7 @@ steps: - bash: | set -euo pipefail git add -u -- common/changes - git add -- '**/CHANGELOG.md' '**/CHANGELOG.json' '**/package.json' + git add -- '**/CHANGELOG.md' '**/CHANGELOG.json' '**/package.json' 'common/config/rush/version-policies.json' if [ -n "$(git diff --cached --numstat)" ]; then git commit -m "Applying package version bumps