refactor: publish to the release branch

[IlyaKhD]

Practical Value

This is required to guarantee JS actions bundles are build in a trusted environment

Decisions

Single release branch

All actions will be published to the same release branch. We previously considered using separate branches, but I can't recall the reasoning, and using the same branch is simpler. History can be tracked individually per action (via folder history).

Each action will have a dedicated tag that's updated on each publish (e.g., repository-check), so you can reference it as DevExpress/github-actions/.github/workflows/repository-check.yml@repository-check

Publish on push

I think it's more reliable since we need to publish changes frequently to address dependency alert fixes.

[Copilot]

Pull request overview

This PR refactors the action publishing flow to publish built artifacts to a dedicated release branch (built in CI), while reorganizing the repository into a packages/* pnpm workspace and adding/adjusting several GitHub Actions and reusable workflows.

Changes:

• Add a CI workflow + script to build artifacts on main and publish them to a release branch with tags.
• Convert the repo to a packages/* pnpm workspace and introduce shared bundling/copy scripts for publishing actions/workflows.
• Add new “code-scanning” utilities/actions (lock-file validation, Node version validation, pnpm audit), plus several other actions/workflows.

Reviewed changes

Copilot reviewed 45 out of 77 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/publish-actions.sh	Publishes built artifacts into a separate git worktree and pushes to a release branch/tags
scripts/copy-workflow.mjs	Copies a package’s workflow.yml into a root-level reusable workflow file
scripts/copy-composite-action.mjs	Copies a composite action directory into a publishable root-level action directory
scripts/bundle-js-action.mjs	Bundles a JS action from lib/main.js into dist/index.js and copies action.yml
pnpm-workspace.yaml	Switch workspace discovery to packages/* and adjust build allowlist config
pnpm-lock.yaml	Updates lockfile for the workspace restructure and dependency moves
packages/verify-version-change/tsconfig.json	Adds package-local TypeScript config
packages/verify-version-change/src/main.ts	Implements “verify version bump” action logic
packages/verify-version-change/package.json	Updates build/dist scripts to use shared bundling
packages/verify-version-change/action.yml	Defines the verify-version-change node action interface
packages/validate-sbom/tsconfig.json	Adds package-local TypeScript config
packages/validate-sbom/src/main.ts	Adds CycloneDX CLI download + SBOM validation logic
packages/validate-sbom/package.json	Updates build/dist scripts to use shared bundling
packages/validate-sbom/action.yml	Defines the validate-sbom node action interface
packages/validate-node-versions/tsconfig.json	Adds package-local TypeScript config
packages/validate-node-versions/src/main.ts	Adds wrapper action invoking code-scanning node version checks
packages/validate-node-versions/package.json	Introduces validate-node-versions action package metadata/scripts
packages/validate-node-versions/action.yml	Defines the validate-node-versions node action interface
packages/validate-lock-files/tsconfig.json	Fixes tsconfig base path reference
packages/validate-lock-files/src/main.ts	Adds wrapper action invoking code-scanning lock file checks
packages/validate-lock-files/package.json	Introduces validate-lock-files action package metadata/scripts
packages/validate-lock-files/action.yml	Defines the validate-lock-files node action interface
packages/send-teams-notification/tsconfig.json	Fixes tsconfig base path reference
packages/send-teams-notification/src/main.ts	Adds Teams notification logic for alerts / failed workflows
packages/send-teams-notification/src/dto/dependabot-alert.dto.ts	Adds DTO types for Dependabot alert payloads
packages/send-teams-notification/package.json	Updates build/dist scripts to use shared bundling
packages/send-teams-notification/action.yml	Defines the send-teams-notification node action interface
packages/repository-check/workflow.yml	Adds reusable “repository check” workflow calling the new actions
packages/repository-check/package.json	Adds workflow “dist” script to generate root workflow file
packages/pr-filter/tsconfig.json	Adds package-local TypeScript config
packages/pr-filter/src/main.ts	Adds PR path-filter action logic using shared common helpers
packages/pr-filter/package.json	Updates build/dist scripts to use shared bundling
packages/pr-filter/action.yml	Defines the pr-filter node action interface
packages/pnpm-audit/tsconfig.json	Adds package-local TypeScript config
packages/pnpm-audit/src/main.ts	Adds wrapper action invoking code-scanning pnpm audit
packages/pnpm-audit/package.json	Introduces pnpm-audit action package metadata/scripts
packages/pnpm-audit/action.yml	Defines the pnpm-audit node action interface
packages/lgtm/package.json	Adds composite-action packaging scripts for publishable output
packages/lgtm/action.yml	Adds composite LGTM action that fetches project/analysis/SARIF data
packages/install-internal-package/replace-package.js	Adds script to replace an installed package with a tgz archive
packages/install-internal-package/package.json	Adds composite-action packaging scripts for publishable output
packages/install-internal-package/action.yml	Adds composite action for installing internal packages from GitHub Packages
packages/get-changed-files/tsconfig.json	Adds package-local TypeScript config
packages/get-changed-files/src/main.ts	Adds action to collect and persist changed files filtered by globs
packages/get-changed-files/package.json	Updates build/dist scripts to use shared bundling
packages/get-changed-files/action.yml	Defines the get-changed-files node action interface
packages/common/tsconfig.json	Fixes tsconfig base path reference
packages/common/src/pr-utils.ts	Adds PR/push revision-range and changed-file helper functions
packages/common/src/path-utils.ts	Adds minimatch-based path filtering and input path splitting
packages/common/src/path-utils.test.ts	Adds unit tests for path utilities
packages/common/src/index.ts	Exports common utilities
packages/common/src/fs-utils.ts	Adds filesystem helper to ensure parent directories exist
packages/common/src/constants.ts	Adds shared input/output name constants for actions
packages/common/src/common-utils.ts	Adds shared command execution helper
packages/common/package.json	Adds common package metadata and dependencies
packages/code-scanning/tsconfig.test.json	Adds test-only TS config for code-scanning package
packages/code-scanning/tsconfig.json	Adds build TS config for code-scanning package
packages/code-scanning/src/validate-node-versions.ts	Adds Node version discovery + reporting logic
packages/code-scanning/src/validate-node-versions.test.ts	Adds unit tests for Node version validation
packages/code-scanning/src/validate-lock-files.ts	Adds lock file discovery + reporting logic
packages/code-scanning/src/validate-lock-files.test.ts	Adds unit tests for lock file discovery logic
packages/code-scanning/src/shared-types.ts	Adds shared report/result types and constants
packages/code-scanning/src/pnpm-audit.ts	Adds pnpm audit orchestration, parsing, workspace detection, and reporting
packages/code-scanning/src/pnpm-audit.test.ts	Adds unit tests for advisory ignore filtering
packages/code-scanning/src/index.ts	Exports code-scanning public APIs/types
packages/code-scanning/src/file-system.ts	Adds filesystem abstraction + mock implementation for tests
packages/code-scanning/src/config.ts	Adds JSON5-based configuration parsing for repo checks
packages/code-scanning/scripts/run.ts	Adds local runner script to execute code-scanning tasks
packages/code-scanning/package.json	Adds code-scanning package metadata/scripts/dependencies
package.json	Updates dist script ordering and moves @vercel/ncc dependency to the root
.gitignore	Expands ignored publish outputs and standardizes lib/ ignore pattern
.github/workflows/publish-actions.yml	Adds CI workflow to build artifacts and publish them to the release branch

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 45 out of 77 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

scripts/publish-actions.sh:27

• This script relies on several environment variables (e.g. BRANCH, TAGS, etc.). With set -u, running it without one of these variables will fail with an unhelpful “unbound variable” error, and $TAGS currently cannot be omitted safely. Add explicit checks/defaults near the top for clearer failures and safer local usage.

[Copilot]

Pull request overview

Copilot reviewed 45 out of 77 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (3)

packages/repository-check/workflow.yml:15

• runs-on: ubuntu-slim is not a standard GitHub-hosted runner label. If this reusable workflow is consumed from other repos without a self-hosted runner providing that label, the workflow will fail to start. Consider using a GitHub-hosted label (e.g. ubuntu-latest / ubuntu-24.04) or documenting the required runner.
  .github/workflows/publish.yml:17
• runs-on: ubuntu-slim is not a standard GitHub-hosted runner label. If this workflow is expected to run on GitHub-hosted runners, switch to ubuntu-latest/ubuntu-24.04; otherwise consider documenting that a self-hosted runner with the ubuntu-slim label is required.

    runs-on: ubuntu-slim

.github/workflows/publish.yml:66

• PR description says each published action will have a dedicated tag updated on each publish, but the TAGS list omits validate-lock-files, validate-node-versions, and pnpm-audit (even though they’re published via ACTION_DIRS). Either add tags for them here or adjust the PR description/consumption strategy.

          TAGS: |
            get-changed-files
            pr-filter
            send-teams-notification
            validate-sbom
            verify-version-change
            install-internal-package
            lgtm
            repository-check

[Copilot]

Pull request overview

Copilot reviewed 45 out of 77 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (3)

packages/repository-check/workflow.yml:15

• runs-on: ubuntu-slim is not a standard GitHub-hosted runner label. Unless all consumers provide a self-hosted runner with that label, this reusable workflow will fail to start. Use a GitHub-hosted label like ubuntu-latest or ubuntu-24.04.
  scripts/copy-composite-action.mjs:20
• The async copy() call is not awaited. If any fs operation rejects, it becomes an unhandled promise rejection (and the process may exit before the copy completes in some environments). Use top-level await so failures surface and the script reliably finishes.
  scripts/bundle-js-action.mjs:22
• The async build() call is not awaited, which can hide failures as unhandled promise rejections and can let the process terminate before bundling completes. Use top-level await so the script reliably completes and fails CI when bundling fails.