ci: add CI, CodeQL and release automation (#18)

* chore: stop tracking the generated build output

`prepare` runs `expo-module build` on every install, so `build/` was already
being regenerated behind the tracked copy, which is a babel version behind
what the source compiles to now.

It also blocks release-it: every `yarn install` leaves the tree dirty, and a
dirty tree aborts a release.

npm still gets the directory. It's in `files`, and `prepare` rebuilds it on
publish and on git installs.

* build(deps): add eslint 8 and release-it

`yarn lint` has been broken because eslint isn't in the lockfile at all, so it
resolved to v10, which wants a flat config while the repo has `.eslintrc.js`.
expo-module-scripts pulls eslint-config-universe 12, and that one is built
against eslint 8.

release-it and @release-it/conventional-changelog are for the release
workflow.

* ci: add validation and codeql workflows

The repo had no workflows at all, so nothing ran on a PR.

CI covers pushes to master and every PR: lint, test, build, then `npm pack
--dry-run` so an empty tarball fails the job now that `build/` is generated at
install time instead of committed.

CodeQL follows safe-jsx: PRs, pushes to master, and a weekly scan.

* ci: cut releases with release-it and a generated changelog

1.0.8 was bumped, tagged, released and published by hand, and CHANGELOG.md
stopped at 1.0.6 under `@config-plugins/react-native-codepush`, a name this
package has never been published under.

release-it now derives all of it from the conventional commits since the last
tag: the version bump, the CHANGELOG section, the annotated tag message and the
GitHub release body. A `!` or a `BREAKING CHANGE:` footer bumps the major and
shows up under the same `⚠ BREAKING CHANGES` heading in all three.

The trigger is `workflow_dispatch` with an optional increment override, not a
push to master. conventional-commits treats any commit as at least a patch, so
pushing a README fix would otherwise ship a version.

Backfilled 1.0.7 and 1.0.8 from git history and reshaped the older entries into
the layout release-it writes, so the file reads as one thing.

* build(deps): add prettier so eslint stops hanging

`yarn lint` didn't fail on eslint 8, it hung with no output, in CI and locally.

eslint-config-universe peer-requires `prettier >=3` and it was never installed.
eslint-plugin-prettier 5 loads prettier through a synckit worker, and with
nothing to load the worker never answers, so eslint blocks forever inside the
`prettier/prettier` rule. Nothing prints because the rule never returns.

With prettier 3.9.6 installed, `yarn lint` finishes in 4 seconds.

* style: format src with prettier 3

`eslint src --fix`. prettier 3 defaults `trailingComma` to `all` where 2
defaulted to `es5`, so almost all of this is commas. The indentation changes in
stringsDependency and infoPlistDependency come from #11 and #14, which were
written while lint was hanging.

* ci: fail lint on warnings

universe sets most of its rules to `warn`, so `yarn lint` exits 0 no matter
what eslint reports. src is clean as of the commit before this one, so
`--max-warnings 0` starts from zero.

Author: GSTJ

.github/workflows/ci.yml

@@ -0,0 +1,41 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: Lint, test and build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: yarn
+
+      # `prepare` runs `expo-module prepare`, so this already builds once.
+      - run: yarn install --frozen-lockfile
+
+      # universe sets most of its rules to `warn`, so without this the step
+      # passes no matter what eslint finds.
+      - run: yarn lint --max-warnings 0
+
+      - run: yarn test
+
+      - run: yarn build
+
+      # `build/` is generated, so the only way to know the published tarball
+      # isn't empty is to pack one.
+      - name: Check the tarball contents
+        run: npm pack --dry-run

.github/workflows/codeql.yml

@@ -0,0 +1,36 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    - cron: "38 1 * * 2"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript"]
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/release.yml

@@ -0,0 +1,72 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      increment:
+        description: "Version increment. Leave empty to infer it from the conventional commits since the last tag."
+        required: false
+        default: ""
+        type: choice
+        options:
+          - ""
+          - patch
+          - minor
+          - major
+      dry-run:
+        description: "Run release-it without publishing, pushing or tagging."
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # conventional-changelog needs the tags and every commit since the
+          # last one to work out the bump and the changelog entries.
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: yarn
+          registry-url: https://registry.npmjs.org/
+
+      - run: yarn install --frozen-lockfile
+
+      - run: yarn lint --max-warnings 0
+
+      - run: yarn test
+
+      - run: yarn build
+
+      # release-it pushes the version commit and the tag back to master, and
+      # actions/checkout leaves the branch without an upstream to push to.
+      - run: git branch --set-upstream-to=origin/${{ github.ref_name }}
+
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          INCREMENT: ${{ inputs.increment }}
+          DRY_RUN: ${{ inputs.dry-run }}
+        run: |
+          git config user.email "gabrielstaveira@gmail.com"
+          git config user.name "Gabriel Taveira"
+
+          args="--ci"
+          if [ -n "$INCREMENT" ]; then
+            args="$args --increment=$INCREMENT"
+          fi
+          if [ "$DRY_RUN" = "true" ]; then
+            args="$args --dry-run"
+          fi
+
+          yarn release $args

.gitignore

@@ -1,2 +1,6 @@
 node_modules
-.idea
+.idea
+
+# Generated by `expo-module build`, which the `prepare` script runs on every
+# install and on publish.
+build

CHANGELOG.md

@@ -1,15 +1,39 @@
-### @config-plugins/react-native-codepush 1.0.0
+# Changelog
 
-- Expo SDK 49 support
+## [1.0.8](https://github.com/GSTJ/react-native-code-push-plugin/compare/1.0.7...v1.0.8) (2026-07-25)
+
+### Features
+
+- support self-hosted codepush servers ([#11](https://github.com/GSTJ/react-native-code-push-plugin/issues/11))
+
+### Bug Fixes
+
+- let node resolve the codepush gradle paths ([#12](https://github.com/GSTJ/react-native-code-push-plugin/issues/12))
+
+## [1.0.7](https://github.com/GSTJ/react-native-code-push-plugin/compare/1.0.6...1.0.7) (2024-02-08)
+
+### Bug Fixes
 
-### @config-plugins/react-native-codepush 1.0.2
+- kotlin/java semicolon build error ([#7](https://github.com/GSTJ/react-native-code-push-plugin/issues/7))
 
-- Update interim README
+## 1.0.6 (2024-01-22)
 
-### @config-plugins/react-native-codepush 1.0.6
+### Features
 
-- Expo SDK 50 support
+- Expo SDK 50 support ([#5](https://github.com/GSTJ/react-native-code-push-plugin/issues/5))
 
-### @config-plugins/react-native-codepush 1.0.6
+### Bug Fixes
 
-- Fix SDK 49 build error
+- Expo SDK 49 build error
+
+## 1.0.2 (2023-11-06)
+
+### Documentation
+
+- update the interim README
+
+## 1.0.0 (2023-11-06)
+
+### Features
+
+- Expo SDK 49 support