chore(ci): add automated dated release workflow

.github/workflows/auto-release.yml

@@ -0,0 +1,127 @@
+name: Automated Releases
+
+on:
+  schedule:
+    - cron: '0 0 * * 0'
+  workflow_dispatch:
+
+concurrency:
+  group: automated-release
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: read
+
+jobs:
+  tag-and-release:
+    name: Create dated tag and release notes
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout current main
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          ref: main
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Determine release target
+        id: target
+        run: |
+          set -euo pipefail
+          TARGET_SHA=$(git rev-parse HEAD)
+          echo "target_sha=$TARGET_SHA" >> "$GITHUB_OUTPUT"
+          echo "Release target: $TARGET_SHA"
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Setup Bun for scripts
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version: '1.3.14'
+
+      - name: Install JS/TS deps
+        run: bun install --frozen-lockfile
+
+      - name: Build release notes (TypeScript)
+        id: build_notes
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TARGET_SHA: ${{ steps.target.outputs.target_sha }}
+        run: |
+          set -euo pipefail
+          bun ./scripts/release-notes.ts
+          test -s RELEASE_NOTES.md
+
+      - name: Select or recover dated tag
+        id: release_tag
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.build_notes.outputs.tag }}
+          TAG_ACTION: ${{ steps.build_notes.outputs.tag_action }}
+          RELEASE_TARGET_SHA: ${{ steps.build_notes.outputs.release_target_sha }}
+        run: |
+          set -euo pipefail
+
+          REPOSITORY_URL="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+
+          case "$TAG_ACTION" in
+            reuse|recover)
+              EXISTING_SHA=$(git rev-list -n 1 "$TAG^{commit}")
+
+              if [ "$EXISTING_SHA" != "$RELEASE_TARGET_SHA" ]; then
+                echo "Selected tag $TAG does not point to release target $RELEASE_TARGET_SHA"
+                exit 1
+              fi
+
+              echo "Using existing tag $TAG at $RELEASE_TARGET_SHA"
+              ;;
+
+            create)
+              echo "Creating annotated tag $TAG at $RELEASE_TARGET_SHA"
+              git tag -a "$TAG" "$RELEASE_TARGET_SHA" -m "Automated release $TAG"
+              git push "$REPOSITORY_URL" "refs/tags/$TAG"
+              ;;
+
+            *)
+              echo "Unknown tag action: $TAG_ACTION"
+              exit 1
+              ;;
+          esac
+
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Publish or recover GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.release_tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+
+          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            DRAFT=$(gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json isDraft -q .isDraft)
+            PRERELEASE=$(gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json isPrerelease -q .isPrerelease)
+
+            if [ "$DRAFT" = "true" ] || [ "$PRERELEASE" = "true" ]; then
+              echo "Publishing existing release $TAG"
+              gh release edit "$TAG" \
+                --repo "$GITHUB_REPOSITORY" \
+                --draft=false \
+                --prerelease=false \
+                --notes-file RELEASE_NOTES.md
+            else
+              echo "Release $TAG already exists. Nothing to publish."
+            fi
+
+            exit 0
+          fi
+
+          gh release create "$TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "$TAG" \
+            --notes-file RELEASE_NOTES.md
+
+          echo "Published release $TAG"

docs/roadmap.md

@@ -140,9 +140,10 @@ enforced.
 ## Releases
 
 Orbit ships continuously from `main`. There are no long lived release branches
-and no backporting, so self-hosted deployments should track `main` or a recent
-tag.
+and no backporting. To make deployments traceable we publish automated dated
+tags and GitHub releases weekly, with manual dispatch available when needed, so
+self-hosted deployments can track `main` or a recent dated tag.
 
 Anything requiring action from someone self-hosting is labelled
 [`breaking change`](https://github.com/Noveum/orbit/labels/breaking%20change)
-and called out in the release notes.
+and called out prominently in the generated release notes.

docs/self-hosting.md

@@ -261,11 +261,13 @@ bun run build
 Always complete the database release before the code that depends on it goes live.
 The production Vercel build refuses to deploy when the configured database cannot
 be verified or is missing a required schema object. Additional legacy tables and
-indexes are reported and preserved. Orbit ships continuously from `main` and there
-is no backporting, so track `main` or a recent tag.
+indexes are reported and preserved. Orbit ships continuously from `main`. We
+also publish automated weekly dated tags and GitHub releases, with manual
+workflow dispatch available when needed, so you can track `main` or a recent
+dated tag for deployed versions.
 
 Watch the [releases](https://github.com/Noveum/orbit/releases) for anything
-labelled `breaking change`.
+labelled `breaking change` and follow the upgrade notes in the associated release.
 
 ### Backups
 

package.json

@@ -28,7 +28,7 @@
     "build": "bun run --filter '*' build",
     "dev": "bun run --filter '*' dev",
     "typecheck": "tsc -p scripts/tsconfig.json --noEmit && bun run --filter '*' typecheck",
-    "test": "bun run --filter '*' test",
+    "test": "bun test ./tests/*.test.ts && bun run --filter '*' test",
     "test:e2e": "bun run --filter '@orbit/web' test:e2e",
     "lint": "biome check .",
     "lint:fix": "biome check --write .",
@@ -59,6 +59,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.7",
+    "@orbit/shared": "workspace:*",
     "@types/bun": "1.3.14",
     "lefthook": "2.1.10",
     "typescript": "5.9.3"

packages/shared/src/validators/github-release.ts

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+
+const labelSchema = z.object({
+  name: z.string(),
+});
+
+export const pullRequestSchema = z.object({
+  number: z.number(),
+  title: z.string(),
+  html_url: z.string().url(),
+  body: z.string().nullable(),
+  labels: z.array(labelSchema),
+  merged_at: z.string().nullable(),
+  base: z.object({
+    ref: z.string(),
+  }),
+});
+
+export const pullRequestListSchema = z.array(pullRequestSchema);
+
+export const githubCommitSchema = z.object({
+  sha: z.string().min(1),
+});
+
+export const commitPageSchema = z.array(githubCommitSchema);
+
+export const releaseSchema = z.object({
+  tag_name: z.string().min(1),
+  draft: z.boolean(),
+  prerelease: z.boolean(),
+  published_at: z.string().nullable(),
+});
+
+export const releaseListSchema = z.array(releaseSchema);
+
+export type PullRequest = z.infer<typeof pullRequestSchema>;
+export type GitHubCommit = z.infer<typeof githubCommitSchema>;
+export type GitHubRelease = z.infer<typeof releaseSchema>;

packages/shared/src/validators/index.ts

@@ -6,6 +6,7 @@ export * from './comment.ts';
 export * from './common.ts';
 export * from './cycle.ts';
 export * from './doc.ts';
+export * from './github-release.ts';
 export * from './integration.ts';
 export * from './issue.ts';
 export * from './label.ts';