chore(release): publish

- @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected].6

.github/workflows/desktop.release.reuse.yml

@@ -330,7 +330,9 @@ jobs:
 
       - name: Install Snapcraft
         run: |
-          sudo snap install snapcraft --classic
+          # Pin to 8.x: electron-builder's legacy core22 snap target calls `snapcraft snap`,
+          # which was removed in snapcraft 9.0 (renamed to `pack`).
+          sudo snap install snapcraft --classic --channel=8.x/stable
 
       - name: Setup LXD
         uses: canonical/[email protected]
@@ -414,5 +416,5 @@ jobs:
 
       - name: Publish Snap
         run: |
-          sudo snap install snapcraft --classic
+          sudo snap install snapcraft --classic --channel=8.x/stable
           snapcraft upload dist/standard-notes-${{ env.APP_VERSION }}-linux-amd64.snap --release stable,candidate,beta,edge

.github/workflows/mobile.release.closed-beta.yml

@@ -23,6 +23,9 @@ jobs:
         with:
           distribution: 'zulu'
           java-version: '17'
+      - name: Setup Android SDK
+        run: |
+          echo "y" | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "platforms;android-36" "build-tools;36.0.0"
       - name: Export version for closed beta
         run: |
           BASE_VERSION=$(grep '"version"' ../web/package.json | cut -d '"' -f 4 | cut -d "-" -f 1)

.github/workflows/mobile.release.prod.yml

@@ -21,6 +21,9 @@ jobs:
         with:
           distribution: 'zulu'
           java-version: '17'
+      - name: Setup Android SDK
+        run: |
+          echo "y" | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "platforms;android-36" "build-tools;36.0.0"
       - name: Export version from package.json
         run:
           echo "PACKAGE_VERSION=$(grep '"version"' ../web/package.json | cut -d '"' -f 4 | cut -d "-" -f 1)" >> $GITHUB_ENV

.github/workflows/publish.yml

@@ -3,8 +3,15 @@ name: Publish Packages
 on:
   push:
     branches: [main]
+  workflow_dispatch:
+    inputs:
+      package:
+        description: 'Package to publish (e.g. @standardnotes/releases)'
+        required: true
+        type: string
 
 # Use commit message "[snjs docker only]" to build/push only standardnotes/snjs (:sha + :latest) for E2E; skips full build, web image, and NPM.
+# Manual dispatch publishes tagged packages from an existing release commit without bumping versions.
 
 permissions:
   id-token: write
@@ -12,7 +19,7 @@ permissions:
 jobs:
   build:
     name: Build & Test
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -39,7 +46,7 @@ jobs:
 
   build-docker:
     name: Build Docker Image
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -110,7 +117,7 @@ jobs:
 
   publish-web-docker:
     name: Build and publish Docker Image for Web App
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -148,7 +155,7 @@ jobs:
 
   publish:
     name: Publish to NPM
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -186,10 +193,95 @@ jobs:
       - name: Publish
         run: yarn publish:prod
 
+  publish-from-git-tags:
+    name: Publish to NPM from Git Tags
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.CI_PAT_TOKEN }}
+          ref: main
+          fetch-depth: 0
+
+      - name: Resolve release commit
+        id: release-commit
+        run: |
+          COMMIT="$(git log main --grep='chore(release): publish' -n 1 --format=%H)"
+
+          if [ -z "$COMMIT" ]; then
+            echo "No release commit found on main."
+            exit 1
+          fi
+
+          if ! git cat-file -e "${COMMIT}^{commit}" 2>/dev/null; then
+            echo "Commit ${COMMIT} does not exist."
+            exit 1
+          fi
+
+          TAG_COUNT="$(git tag --points-at "$COMMIT" | wc -l | tr -d ' ')"
+          if [ "$TAG_COUNT" -eq 0 ]; then
+            echo "Commit ${COMMIT} has no release tags."
+            exit 1
+          fi
+
+          echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT"
+          echo "Using release commit ${COMMIT}"
+          git tag --points-at "$COMMIT"
+
+      - name: Checkout release commit
+        run: git checkout "${{ steps.release-commit.outputs.commit }}"
+
+      - name: Set up Node
+        uses: actions/setup-node@v3
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+
+      - name: Upgrade npm (trusted publishing requirement)
+        run: npm install -g npm@^11.5.1
+
+      - name: Enable Corepack (Yarn)
+        run: corepack enable
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Build
+        run: yarn build:all
+
+      - name: Publish tagged package
+        env:
+          PACKAGE: ${{ inputs.package }}
+        run: |
+          set -euo pipefail
+
+          PACKAGE="$(echo "$PACKAGE" | xargs)"
+          if [ -z "$PACKAGE" ]; then
+            echo "Package name is required."
+            exit 1
+          fi
+
+          mapfile -t TAGS < <(git tag --points-at HEAD --list "${PACKAGE}@*")
+          if [ "${#TAGS[@]}" -eq 0 ]; then
+            echo "No release tag found for ${PACKAGE} at the release commit."
+            exit 1
+          fi
+
+          if [ "${#TAGS[@]}" -gt 1 ]; then
+            echo "Multiple release tags found for ${PACKAGE}: ${TAGS[*]}"
+            exit 1
+          fi
+
+          echo "Publishing ${PACKAGE} (${TAGS[0]})..."
+          yarn workspace "$PACKAGE" npm publish --access public
+
   publish-docker:
     name: Publish to Docker Hub
     needs: build-docker
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Login to Docker Hub

.github/workflows/snjs.pr.yml

@@ -79,7 +79,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run E2E test suite
-        uses: convictional/trigger-workflow-and-wait@master
+        uses: convictional/trigger-workflow-and-wait@224756e4cc7fa0b711a281193496319f816cd880 # master
         with:
           owner: standardnotes
           repo: server
@@ -97,7 +97,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run E2E vaults test suite
-        uses: convictional/trigger-workflow-and-wait@master
+        uses: convictional/trigger-workflow-and-wait@224756e4cc7fa0b711a281193496319f816cd880 # master
         with:
           owner: standardnotes
           repo: server

.github/workflows/web.release.prod.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Deploy static site to S3 bucket
         run: aws s3 sync packages/web/dist/ s3://app.standardnotes.com --delete
       - name: Invalidate CloudFront Cache
-        uses: chetan/invalidate-cloudfront-action@master
+        uses: chetan/invalidate-cloudfront-action@fce6f6f546fae2e9fe55f3bd1411063a908f2557 # master
         env:
           DISTRIBUTION: ${{ secrets.WEBAPP_CLOUDFRONT_COM_DISTRIBUTION_ID }}
           PATHS: '/*'
@@ -46,6 +46,6 @@ jobs:
 
     steps:
     - name: Run Discord Webhook
-      uses: johnnyhuy/actions-discord-git-webhook@main
+      uses: johnnyhuy/actions-discord-git-webhook@59b728b6b5cd1c18e4b462f4876d3a0d8e26f23a # main
       with:
         webhook_url: ${{ secrets.DISCORD_WEBHOOK_URL }}