fix(gh-actions): release PR requisted changes

.devcontainer/devcontainer.json

@@ -4,4 +4,4 @@
     "dockerfile": "Dockerfile"
   },
   "postCreateCommand": "code --install-extension /tmp/compact.vsix && compact update 0.26.0"
-}
+}

.github/actions/setup/action.yml

@@ -1,10 +1,30 @@
 name: "Setup Environment"
-description: "Sets up the environment with yarn, Node.js, and turbo"
+description: "Sets up the environment with yarn, Node.js, turbo, and Compact compiler"
+
+inputs:
+  skip-compact:
+    description: "Skip Compact compiler installation"
+    required: false
+    default: "false"
+
+outputs:
+  compact-home:
+    description: "Path to Compact compiler installation"
+    value: ${{ steps.compact-outputs.outputs.compact-home }}
+  compact-version:
+    description: "Installed Compact compiler version"
+    value: ${{ steps.compact-outputs.outputs.version }}
 
 runs:
   using: "composite"
   steps:
-    - name: Enable Corepack
+    - name: Set shared environment variables
+      shell: bash
+      run: |
+        echo "COMPILER_VERSION=0.26.0" >> $GITHUB_ENV
+        echo "LANGUAGE_VERSION=0.18.0" >> $GITHUB_ENV
+
+    - name: Get yarn cache directory path
       shell: bash
       run: corepack enable
 
@@ -16,8 +36,17 @@ runs:
         restore-keys: |
           ${{ runner.os }}-turbo-${{ hashFiles('.turbo/*') }}
 
+    - name: Cache Compact compiler
+      if: inputs.skip-compact != 'true'
+      uses: actions/cache@v4
+      id: compact-cache
+      with:
+        path: |
+          ~/.local/bin/compact
+        key: compact-compiler-${{ env.COMPILER_VERSION }}-${{ runner.os }}
+
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         node-version-file: ".nvmrc"
         cache: "yarn"
@@ -31,5 +60,80 @@ runs:
       env:
         TURBO_MAJOR_VERSION: 2
         TURBO_TELEMETRY_DISABLED: 1
+      run: npm install turbo@${{ env.TURBO_MAJOR_VERSION }} -g
+
+    - name: Install Compact compiler
+      if: inputs.skip-compact != 'true' && steps.compact-cache.outputs.cache-hit != 'true'
+      shell: bash
       run: |
-        npm install turbo@${{ env.TURBO_MAJOR_VERSION }} -g
+        set -euo pipefail
+        COMPACT_HOME="$HOME/.local/bin"
+        mkdir -p "$COMPACT_HOME"
+
+        # Require COMPACT_INSTALLER_URL to be provided by the caller
+        if [ -z "${COMPACT_INSTALLER_URL:-}" ]; then
+          echo "::error::COMPACT_INSTALLER_URL is required but not set. Provide it via env or secrets."
+          exit 1
+        fi
+
+        echo "🔧 Installing Compact compiler from $COMPACT_INSTALLER_URL ..."
+        curl --proto '=https' --tlsv1.2 -LsSf "$COMPACT_INSTALLER_URL" | sh
+
+        echo "🔧 Updating Compact compiler to $COMPILER_VERSION..."
+        "$COMPACT_HOME/compact" update "$COMPILER_VERSION"
+
+        echo "✅ Compact compiler installed"
+
+    - name: Setup Compact environment
+      if: inputs.skip-compact != 'true'
+      shell: bash
+      run: |
+        COMPACT_HOME="$HOME/.local/bin"
+        echo "📁 Setting Compact environment variables..."
+        echo "COMPACT_HOME=$COMPACT_HOME" >> "$GITHUB_ENV"
+        echo "$COMPACT_HOME" >> "$GITHUB_PATH"
+
+        if [ -f "$COMPACT_HOME/compact" ]; then
+          echo "✅ Compact compiler is installed at $COMPACT_HOME"
+        else
+          echo "::error::❌ Compact compiler not found in $COMPACT_HOME"
+          exit 1
+        fi
+
+    - name: Set Compact outputs
+      if: inputs.skip-compact != 'true'
+      id: compact-outputs
+      shell: bash
+      run: |
+        echo "compact-home=$HOME/.local/bin" >> $GITHUB_OUTPUT
+        echo "version=$COMPILER_VERSION" >> $GITHUB_OUTPUT
+
+    - name: Check compiler and language version
+      if: inputs.skip-compact != 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        echo "🔧 Updating Compact compiler to $COMPILER_VERSION..."
+        "$COMPACT_HOME/compact" update "$COMPILER_VERSION"
+
+        echo "🔍 Checking Compact compiler version..."
+        COMPILER_OUTPUT=$("$COMPACT_HOME/compact" compile --version)
+        COMPUTED_COMPILER_VERSION=$(echo "$COMPILER_OUTPUT" | grep -oP '\b0\.[0-9]+\.[0-9]+\b' | head -n 1)
+
+        if [ "$COMPUTED_COMPILER_VERSION" != "$COMPILER_VERSION" ]; then
+          echo "::error::❌ Compiler version mismatch!%0AExpected: $COMPILER_VERSION%0AGot: $COMPUTED_COMPILER_VERSION"
+          exit 1
+        fi
+        echo "✅ Compiler version matches: $COMPUTED_COMPILER_VERSION"
+
+        echo "🔍 Checking Compact language version..."
+        LANGUAGE_OUTPUT=$("$COMPACT_HOME/compact" compile --language-version)
+        COMPUTED_LANGUAGE_VERSION=$(echo "$LANGUAGE_OUTPUT" | grep -oP '\b0\.[0-9]+\.[0-9]+\b' | tail -n 1)
+
+        if [ "$COMPUTED_LANGUAGE_VERSION" != "$LANGUAGE_VERSION" ]; then
+          echo "::error::❌ Language version mismatch!%0AExpected: $LANGUAGE_VERSION%0AGot: $COMPUTED_LANGUAGE_VERSION"
+          exit 1
+        fi
+        echo "✅ Language version matches: $COMPUTED_LANGUAGE_VERSION"
+

.github/workflows/checks.yml

@@ -14,6 +14,9 @@ jobs:
     name: Run Checks
     runs-on: ubuntu-24.04
 
+    env:
+      COMPACT_INSTALLER_URL: ${{ vars.COMPACT_INSTALLER_URL }}
+
     steps:
       - name: Check out code
         uses: actions/checkout@v5

.github/workflows/codeql.yml

@@ -22,6 +22,9 @@ jobs:
       matrix:
         language: ["javascript", "typescript"]
 
+    env:
+      COMPACT_INSTALLER_URL: ${{ vars.COMPACT_INSTALLER_URL }}
+
     steps:
       - name: Check out code
         uses: actions/checkout@v5

.github/workflows/prepare-release.yml

@@ -0,0 +1,83 @@
+name: Update version on new release branch
+
+on:
+  create:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update_version:
+    if: github.ref_type == 'branch' && startsWith(github.ref, 'refs/heads/release-v')
+    runs-on: ubuntu-24.04
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5
+
+    - name: Setup Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version-file: ".nvmrc"
+        cache: "yarn"
+
+    - name: Extract current version
+      run: |
+        CURRENT_VERSION=$(node -p "require('./contracts/package.json').version")
+        echo "CURRENT_VERSION=$CURRENT_VERSION" >> "$GITHUB_ENV"
+
+    - name: Extract new version number
+      run: echo "NEW_VERSION=${GITHUB_REF#refs/heads/release-v}" >> "$GITHUB_ENV"
+
+    - name: Validate new version
+      run: |
+        BRANCH="${GITHUB_REF#refs/heads/}"
+        echo "Branch: $BRANCH"
+        echo "Current version: $CURRENT_VERSION"
+        echo "New version: $NEW_VERSION"
+
+        # 1) Branch must match release-v<semver>
+        if ! echo "$BRANCH" | grep -Eq '^release-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'; then
+          echo "Error: Branch '$BRANCH' must match 'release-v<semver>' (e.g., release-v1.2.3)." >&2
+          exit 1
+        fi
+
+        # 2) NEW_VERSION must be valid semver
+        node -e "const v=process.env.NEW_VERSION; const semver=/^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-([0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*))?(?:\\+([0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*))?$/; if(!semver.test(v)){ console.error('Error: NEW_VERSION is not valid semver:', v); process.exit(1); }"
+        if [ $? -ne 0 ]; then
+          exit 1
+        fi
+
+        # 3) NEW_VERSION must differ from CURRENT_VERSION
+        if [ "$NEW_VERSION" = "$CURRENT_VERSION" ]; then
+          echo "Error: NEW_VERSION equals CURRENT_VERSION ($CURRENT_VERSION). Nothing to release." >&2
+          exit 1
+        fi
+
+    - name: Replace version in files
+      env:
+        NEW_VERSION: ${{ env.NEW_VERSION }}
+      run: |
+        echo "Current version: $CURRENT_VERSION"
+        echo "New version: $NEW_VERSION"
+
+        # Update package.json version field manually
+        yarn workspace @openzeppelin-compact/contracts version "$NEW_VERSION"
+
+        # Escape special characters for sed
+        ESCAPED_CURRENT=$(printf '%s' "$CURRENT_VERSION" | sed -e 's/[\/&]/\\&/g')
+        ESCAPED_NEW=$(printf '%s' "$NEW_VERSION" | sed -e 's/[\/&]/\\&/g')
+
+        # Replace version in contracts/src/
+        find ./contracts/src/ -type d -name '.*' -prune -o \
+          -type f -exec sed -i "s#$ESCAPED_CURRENT#$ESCAPED_NEW#g" {} +
+
+        # Replace version in docs/, excluding package-lock.json
+        find ./docs/ -type d -name '.*' -prune -o \
+          -type f ! -name 'package-lock.json' -exec sed -i "s#$ESCAPED_CURRENT#$ESCAPED_NEW#g" {} +
+
+    - name: Auto-commit changes
+      uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 #v6.0.1
+      with:
+        commit_message: Bump version to ${{ env.NEW_VERSION }}

.github/workflows/release.yml

@@ -0,0 +1,93 @@
+name: Publish Package on Release
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+
+    env:
+      COMPACT_INSTALLER_URL: ${{ vars.COMPACT_INSTALLER_URL }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup Environment
+        uses: ./.github/actions/setup
+
+      - name: Build contracts
+        run: turbo build --filter=!'docs'
+
+      - name: Validate version consistency
+        run: |
+          RELEASE_VERSION=${GITHUB_REF#refs/tags/v}
+          PACKAGE_VERSION=$(node -p "require('./contracts/package.json').version")
+          if [ "$RELEASE_VERSION" != "$PACKAGE_VERSION" ]; then
+            echo "❌ Version mismatch: Release $RELEASE_VERSION vs Package $PACKAGE_VERSION"
+            exit 1
+          fi
+          echo "✅ Version consistency validated: $RELEASE_VERSION"
+
+      - name: Setup npm registry
+        uses: actions/setup-node@v6
+        with:
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Pack tarball
+        id: pack
+        run: |
+          cd contracts/dist
+          TARBALL=$(npm pack | tail -1)
+          echo "tarball_name=$TARBALL" >> $GITHUB_OUTPUT
+          echo "tarball=$(pwd)/$TARBALL" >> $GITHUB_OUTPUT
+
+          # Determine dist-tag based on semver prerelease
+          PACKAGE_VERSION=$(node -p "require('./package.json').version")
+          if [[ "$PACKAGE_VERSION" =~ -.*$ ]]; then
+            # Has prerelease suffix (anything after -)
+            if [[ "$PACKAGE_VERSION" =~ -(alpha|beta|rc) ]]; then
+              echo "tag=beta" >> $GITHUB_OUTPUT
+            else
+              echo "tag=next" >> $GITHUB_OUTPUT
+            fi
+          else
+            # Stable release
+            echo "tag=latest" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Verify tarball integrity
+        run: |
+          echo "=== Verifying tarball contents ==="
+          PACKAGE_NAME=$(tar xfO "${{ steps.pack.outputs.tarball }}" package/package.json | jq -r .name)
+          PACKAGE_VERSION=$(tar xfO "${{ steps.pack.outputs.tarball }}" package/package.json | jq -r .version)
+          PRIVATE_FIELD=$(tar xfO "${{ steps.pack.outputs.tarball }}" package/package.json | jq -r '.private // "not found"')
+
+          echo "📦 Package: $PACKAGE_NAME@$PACKAGE_VERSION"
+          echo "🏷️  Tag: ${{ steps.pack.outputs.tag }}"
+          echo "🔒 Private field: $PRIVATE_FIELD"
+
+          # Ensure no private field
+          if [ "$PRIVATE_FIELD" = "true" ]; then
+            echo "❌ Tarball contains private: true - cannot publish"
+            exit 1
+          fi
+
+      - name: Publish to npm
+        run: |
+          # Publish the tarball with appropriate tag
+          npm publish "${{ steps.pack.outputs.tarball }}" --tag "${{ steps.pack.outputs.tag }}" --access public --provenance
+        env:
+          NPM_CONFIG_PROVENANCE: true
+
+      - name: Log success
+        run: |
+          PACKAGE_NAME=$(tar xfO "${{ steps.pack.outputs.tarball }}" package/package.json | jq -r .name)
+          PACKAGE_VERSION=$(tar xfO "${{ steps.pack.outputs.tarball }}" package/package.json | jq -r .version)
+          echo "✅ Successfully published $PACKAGE_NAME@$PACKAGE_VERSION to npm with tag ${{ steps.pack.outputs.tag }}"
+          echo "📦 Install with: npm install $PACKAGE_NAME@${{ steps.pack.outputs.tag }}"