refactor: publish to the release branch

[IlyaKhD]

Practical Value

This is required to guarantee JS actions bundles are build in a trusted environment

Decisions

Single release branch

All actions will be published to the same release branch. We previously considered using separate branches, but I can't recall the reasoning, and using the same branch is simpler. History can be tracked individually per action (via folder history).

Each action will have a dedicated tag that's updated on each publish (e.g., repository-check), so you can reference it as DevExpress/github-actions/.github/workflows/repository-check.yml@repository-check

Publish on push

I think it's more reliable since we need to publish changes frequently to address dependency alert fixes.

[Copilot]

Pull request overview

This PR refactors the action publishing flow to publish built artifacts to a dedicated release branch (built in CI), while reorganizing the repository into a packages/* pnpm workspace and adding/adjusting several GitHub Actions and reusable workflows.

Changes:

• Add a CI workflow + script to build artifacts on main and publish them to a release branch with tags.
• Convert the repo to a packages/* pnpm workspace and introduce shared bundling/copy scripts for publishing actions/workflows.
• Add new “code-scanning” utilities/actions (lock-file validation, Node version validation, pnpm audit), plus several other actions/workflows.

Reviewed changes

Copilot reviewed 45 out of 77 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/publish-actions.sh	Publishes built artifacts into a separate git worktree and pushes to a release branch/tags
scripts/copy-workflow.mjs	Copies a package’s workflow.yml into a root-level reusable workflow file
scripts/copy-composite-action.mjs	Copies a composite action directory into a publishable root-level action directory
scripts/bundle-js-action.mjs	Bundles a JS action from lib/main.js into dist/index.js and copies action.yml
pnpm-workspace.yaml	Switch workspace discovery to packages/* and adjust build allowlist config
pnpm-lock.yaml	Updates lockfile for the workspace restructure and dependency moves
packages/verify-version-change/tsconfig.json	Adds package-local TypeScript config
packages/verify-version-change/src/main.ts	Implements “verify version bump” action logic
packages/verify-version-change/package.json	Updates build/dist scripts to use shared bundling
packages/verify-version-change/action.yml	Defines the verify-version-change node action interface
packages/validate-sbom/tsconfig.json	Adds package-local TypeScript config
packages/validate-sbom/src/main.ts	Adds CycloneDX CLI download + SBOM validation logic
packages/validate-sbom/package.json	Updates build/dist scripts to use shared bundling
packages/validate-sbom/action.yml	Defines the validate-sbom node action interface
packages/validate-node-versions/tsconfig.json	Adds package-local TypeScript config
packages/validate-node-versions/src/main.ts	Adds wrapper action invoking code-scanning node version checks
packages/validate-node-versions/package.json	Introduces validate-node-versions action package metadata/scripts
packages/validate-node-versions/action.yml	Defines the validate-node-versions node action interface
packages/validate-lock-files/tsconfig.json	Fixes tsconfig base path reference
packages/validate-lock-files/src/main.ts	Adds wrapper action invoking code-scanning lock file checks
packages/validate-lock-files/package.json	Introduces validate-lock-files action package metadata/scripts
packages/validate-lock-files/action.yml	Defines the validate-lock-files node action interface
packages/send-teams-notification/tsconfig.json	Fixes tsconfig base path reference
packages/send-teams-notification/src/main.ts	Adds Teams notification logic for alerts / failed workflows
packages/send-teams-notification/src/dto/dependabot-alert.dto.ts	Adds DTO types for Dependabot alert payloads
packages/send-teams-notification/package.json	Updates build/dist scripts to use shared bundling
packages/send-teams-notification/action.yml	Defines the send-teams-notification node action interface
packages/repository-check/workflow.yml	Adds reusable “repository check” workflow calling the new actions
packages/repository-check/package.json	Adds workflow “dist” script to generate root workflow file
packages/pr-filter/tsconfig.json	Adds package-local TypeScript config
packages/pr-filter/src/main.ts	Adds PR path-filter action logic using shared common helpers
packages/pr-filter/package.json	Updates build/dist scripts to use shared bundling
packages/pr-filter/action.yml	Defines the pr-filter node action interface
packages/pnpm-audit/tsconfig.json	Adds package-local TypeScript config
packages/pnpm-audit/src/main.ts	Adds wrapper action invoking code-scanning pnpm audit
packages/pnpm-audit/package.json	Introduces pnpm-audit action package metadata/scripts
packages/pnpm-audit/action.yml	Defines the pnpm-audit node action interface
packages/lgtm/package.json	Adds composite-action packaging scripts for publishable output
packages/lgtm/action.yml	Adds composite LGTM action that fetches project/analysis/SARIF data
packages/install-internal-package/replace-package.js	Adds script to replace an installed package with a tgz archive
packages/install-internal-package/package.json	Adds composite-action packaging scripts for publishable output
packages/install-internal-package/action.yml	Adds composite action for installing internal packages from GitHub Packages
packages/get-changed-files/tsconfig.json	Adds package-local TypeScript config
packages/get-changed-files/src/main.ts	Adds action to collect and persist changed files filtered by globs
packages/get-changed-files/package.json	Updates build/dist scripts to use shared bundling
packages/get-changed-files/action.yml	Defines the get-changed-files node action interface
packages/common/tsconfig.json	Fixes tsconfig base path reference
packages/common/src/pr-utils.ts	Adds PR/push revision-range and changed-file helper functions
packages/common/src/path-utils.ts	Adds minimatch-based path filtering and input path splitting
packages/common/src/path-utils.test.ts	Adds unit tests for path utilities
packages/common/src/index.ts	Exports common utilities
packages/common/src/fs-utils.ts	Adds filesystem helper to ensure parent directories exist
packages/common/src/constants.ts	Adds shared input/output name constants for actions
packages/common/src/common-utils.ts	Adds shared command execution helper
packages/common/package.json	Adds common package metadata and dependencies
packages/code-scanning/tsconfig.test.json	Adds test-only TS config for code-scanning package
packages/code-scanning/tsconfig.json	Adds build TS config for code-scanning package
packages/code-scanning/src/validate-node-versions.ts	Adds Node version discovery + reporting logic
packages/code-scanning/src/validate-node-versions.test.ts	Adds unit tests for Node version validation
packages/code-scanning/src/validate-lock-files.ts	Adds lock file discovery + reporting logic
packages/code-scanning/src/validate-lock-files.test.ts	Adds unit tests for lock file discovery logic
packages/code-scanning/src/shared-types.ts	Adds shared report/result types and constants
packages/code-scanning/src/pnpm-audit.ts	Adds pnpm audit orchestration, parsing, workspace detection, and reporting
packages/code-scanning/src/pnpm-audit.test.ts	Adds unit tests for advisory ignore filtering
packages/code-scanning/src/index.ts	Exports code-scanning public APIs/types
packages/code-scanning/src/file-system.ts	Adds filesystem abstraction + mock implementation for tests
packages/code-scanning/src/config.ts	Adds JSON5-based configuration parsing for repo checks
packages/code-scanning/scripts/run.ts	Adds local runner script to execute code-scanning tasks
packages/code-scanning/package.json	Adds code-scanning package metadata/scripts/dependencies
package.json	Updates dist script ordering and moves @vercel/ncc dependency to the root
.gitignore	Expands ignored publish outputs and standardizes lib/ ignore pattern
.github/workflows/publish-actions.yml	Adds CI workflow to build artifacts and publish them to the release branch

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 45 out of 77 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

scripts/publish-actions.sh:27

• This script relies on several environment variables (e.g. BRANCH, TAGS, etc.). With set -u, running it without one of these variables will fail with an unhelpful “unbound variable” error, and $TAGS currently cannot be omitted safely. Add explicit checks/defaults near the top for clearer failures and safer local usage.

[Copilot]

Pull request overview

Copilot reviewed 45 out of 77 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (3)

packages/repository-check/workflow.yml:15

• runs-on: ubuntu-slim is not a standard GitHub-hosted runner label. If this reusable workflow is consumed from other repos without a self-hosted runner providing that label, the workflow will fail to start. Consider using a GitHub-hosted label (e.g. ubuntu-latest / ubuntu-24.04) or documenting the required runner.
  .github/workflows/publish.yml:17
• runs-on: ubuntu-slim is not a standard GitHub-hosted runner label. If this workflow is expected to run on GitHub-hosted runners, switch to ubuntu-latest/ubuntu-24.04; otherwise consider documenting that a self-hosted runner with the ubuntu-slim label is required.

    runs-on: ubuntu-slim

.github/workflows/publish.yml:66

• PR description says each published action will have a dedicated tag updated on each publish, but the TAGS list omits validate-lock-files, validate-node-versions, and pnpm-audit (even though they’re published via ACTION_DIRS). Either add tags for them here or adjust the PR description/consumption strategy.

          TAGS: |
            get-changed-files
            pr-filter
            send-teams-notification
            validate-sbom
            verify-version-change
            install-internal-package
            lgtm
            repository-check