ci: record package releases in simplex-chat-libs (#7719)

* ci: use default registries for empty variables

* ci: drop package publish tags

* ci: record releases in simplex-chat-libs

* ci: skip recorded versions in publish plan

* nodejs: raise default test timeout for migrations

* nodejs: print download progress without console.error

* nodejs: use the default timeout in migrating core tests

.github/workflows/build.yml

@@ -132,35 +132,26 @@ jobs:
             echo "version=$version" >> $GITHUB_OUTPUT
           fi
 
-      - name: Clone libs repo
-        if: steps.check_version.outputs.version
-        uses: actions/checkout@v3
-        with:
-          repository: ${{ github.repository }}-libs
-          token: ${{ secrets.NODEJS_REPO_TOKEN }}
-          path: libs-repo
-
-      - name: Commit and tag libs release
+      - name: Record libs release
         id: libs_commit
         if: steps.check_version.outputs.version
-        working-directory: libs-repo
+        env:
+          GH_TOKEN: ${{ secrets.NODEJS_REPO_TOKEN }}
+          LIBS_REPOSITORY: ${{ github.repository }}-libs
+          VERSION: ${{ steps.check_version.outputs.version }}
         run: |
-          tag=core-${{ steps.check_version.outputs.version }}
-          printf 'version: %s\ncommit: %s\n' "${{ steps.check_version.outputs.version }}" "${{ github.sha }}" > core-release
-          git config user.name "SimpleX Chat"
-          git config user.email "build@simplex.chat"
-          git add core-release
-          git commit -m "$tag"
-          git tag "$tag"
-          git push --atomic origin HEAD "$tag"
-          echo "tag=$tag" >> $GITHUB_OUTPUT
+          commit=$(python3 scripts/ci/packages_release.py record --core "$VERSION" --commit "$GITHUB_SHA")
+          echo "tag=core-$VERSION" >> "$GITHUB_OUTPUT"
+          echo "commit=$commit" >> "$GITHUB_OUTPUT"
 
+      # creates the tag on the commit that recorded the release
       - name: Create libs release
         if: steps.check_version.outputs.version
         uses: softprops/action-gh-release@v2
         with:
           repository: ${{ github.repository }}-libs
           tag_name: ${{ steps.libs_commit.outputs.tag }}
+          target_commitish: ${{ steps.libs_commit.outputs.commit }}
           token: ${{ secrets.NODEJS_REPO_TOKEN }}
 
 # =========================
@@ -868,7 +859,7 @@ jobs:
     if: ${{ !cancelled() && needs.maybe-release.outputs.libs_tag }}
     # the called workflow can't be granted more than its caller, and its publish job needs these
     permissions:
-      contents: write
+      contents: read
       id-token: write
     uses: ./.github/workflows/packages.yml
     with:
@@ -882,7 +873,7 @@ jobs:
     # build-linux uploads the library before its chat tests run
     if: ${{ !cancelled() && needs.maybe-release.outputs.core_changed }}
     permissions:
-      contents: write
+      contents: read
       id-token: write
     uses: ./.github/workflows/packages.yml
     with:

.github/workflows/packages.yml

@@ -2,7 +2,7 @@ name: packages
 
 # Releases simplex-chat (npm, PyPI) and @simplex-chat/types (npm) from master and stable:
 # 1. A missing Node.js add-on release (nodejs-addon-<hash of its sources>) is built and uploaded to simplex-chat-libs.
-# 2. Versions that are not published yet are published, and tagged <package>-v<version> on their commit.
+# 2. Versions that are not published yet are published, and recorded in releases.toml of simplex-chat-libs.
 #    npm prerelease versions get dist-tag beta, others latest.
 # 3. The release PR packages-release/<branch> pins new library and add-on releases with their SHA-256
 #    and bumps the versions of changed packages. Merging it publishes them (step 2).
@@ -208,18 +208,24 @@ jobs:
     if: needs.addon.outputs.release_branch && contains(github.workflow_ref, '/.github/workflows/packages.yml@')
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
       id-token: write
+    # set by a publish step after it succeeds, so a failed publish still reports the earlier ones
+    outputs:
+      types: ${{ steps.types.outputs.version }}
+      nodejs: ${{ steps.nodejs.outputs.version }}
+      python: ${{ steps.python.outputs.version }}
     env:
       NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
       - name: Checkout Code
         uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
 
       - name: Versions to publish
         id: plan
+        env:
+          GH_TOKEN: ${{ github.token }}
+          LIBS_REPOSITORY: ${{ github.repository }}-libs
         run: python3 scripts/ci/packages_release.py publish-plan >> "$GITHUB_OUTPUT"
 
       - name: Setup Node.js
@@ -250,6 +256,7 @@ jobs:
         run: python3 scripts/ci/packages_release.py test-names
 
       - name: Publish @simplex-chat/types
+        id: types
         if: steps.plan.outputs.types_version
         working-directory: packages/simplex-chat-client/types/typescript
         env:
@@ -258,9 +265,10 @@ jobs:
         run: |
           npm install --no-audit --no-fund
           npm publish --provenance --access public --tag "$DIST_TAG"
-          git tag "types-v$VERSION" && git push origin "types-v$VERSION"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Publish simplex-chat (npm)
+        id: nodejs
         if: steps.plan.outputs.nodejs_version
         working-directory: packages/simplex-chat-nodejs
         env:
@@ -268,7 +276,7 @@ jobs:
           DIST_TAG: ${{ steps.plan.outputs.nodejs_dist_tag }}
         run: |
           npm publish --provenance --access public --tag "$DIST_TAG"
-          git tag "nodejs-v$VERSION" && git push origin "nodejs-v$VERSION"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Build and test simplex-chat (PyPI)
         if: steps.plan.outputs.python_version
@@ -286,15 +294,35 @@ jobs:
           repository-url: ${{ vars.PYPI_UPLOAD_URL || 'https://upload.pypi.org/legacy/' }}
           password: ${{ secrets.PYPI_API_TOKEN }}
 
-      - name: Tag the published PyPI version
+      - name: Report the published PyPI version
+        id: python
         if: steps.plan.outputs.python_version
         env:
           VERSION: ${{ steps.plan.outputs.python_version }}
-        run: git tag "python-v$VERSION" && git push origin "python-v$VERSION"
+        run: echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+  # The only job here that writes to simplex-chat-libs; publish runs npm and pip installs without its token.
+  record:
+    needs: publish
+    if: ${{ !cancelled() && (needs.publish.outputs.types || needs.publish.outputs.nodejs || needs.publish.outputs.python) }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6
+
+      - name: Record published versions
+        env:
+          GH_TOKEN: ${{ secrets.NODEJS_REPO_TOKEN }}
+          LIBS_REPOSITORY: ${{ github.repository }}-libs
+          TYPES: ${{ needs.publish.outputs.types }}
+          NODEJS: ${{ needs.publish.outputs.nodejs }}
+          PYTHON: ${{ needs.publish.outputs.python }}
+        run: |
+          python3 scripts/ci/packages_release.py record --commit "$GITHUB_SHA" \
+            --types "$TYPES" --nodejs "$NODEJS" --python "$PYTHON"
 
   release:
-    # After publish, for its version tags. A failed publish leaves its versions unbumped.
-    needs: [addon, build, publish]
+    needs: [addon, build]
     # A merged release PR changes only versions and pins.
     if: >-
       !cancelled() && needs.addon.outputs.release_branch && needs.build.result != 'failure'