update release-plan for OIDC

ember-cli · mansona · Apr 9, 2026 · Jan 25, 2026 · Jan 25, 2026 · Jan 25, 2026
commit 07f39d678eb303d55a2e185b3170c18a39bf9baa
diff --git a/.github/workflows/plan-alpha-release.yml b/.github/workflows/plan-alpha-release.yml
@@ -9,78 +9,41 @@ on:
     types:
       - labeled
       - unlabeled
-    branches:
-      - master
 
 concurrency:
   group: plan-release # only the latest one of these should ever be running
   cancel-in-progress: true
 
 jobs:
-  is-this-a-release:
-    name: "Is this a release?"
+  should-run-release-plan-prepare:
+    name: Should we run release-plan prepare?
     runs-on: ubuntu-latest
     outputs:
-      command: ${{ steps.check-release.outputs.command }}
-
+      should-prepare: ${{ steps.should-prepare.outputs.should-prepare }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: release-plan/actions/should-prepare-release@v1
         with:
-          fetch-depth: 2
           ref: "master"
-      # This will only cause the `is-this-a-release` job to have a "command" of `release`
-      # when the .release-plan.json file was changed on the last commit.
-      - id: check-release
-        run: if git diff --name-only HEAD HEAD~1 | grep -w -q ".release-plan.json"; then echo "command=release"; fi >> $GITHUB_OUTPUT
+        id: should-prepare
 
   create-prepare-release-pr:
     name: Create Prepare Release PR
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: is-this-a-release
+    needs: should-run-release-plan-prepare
     permissions:
       contents: write
       issues: read
       pull-requests: write
-    # only run on push event or workflow dispatch if plan wasn't updated (don't create a release plan when we're releasing)
-    # only run on labeled event if the PR has already been merged
-    if: ((github.event_name == 'push' || github.event_name == 'workflow_dispatch') && needs.is-this-a-release.outputs.command != 'release') || (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true)
-
+    if: needs.should-run-release-plan-prepare.outputs.should-prepare == 'true'
     steps:
-      - uses: actions/checkout@v6
-        # We need to download lots of history so that
-        # github-changelog can discover what's changed since the last release
+      - uses: release-plan/actions/prepare@v1
+        name: Run release-plan prepare
         with:
-          fetch-depth: 0
           ref: "master"
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - name: "Generate Explanation and Prep Changelogs"
-        id: explanation
-        run: |
-          set +e
-          pnpm release-plan prepare 2> >(tee -a release-plan-stderr.txt >&2)
-
-          if [ $? -ne 0 ]; then
-            release_plan_output=$(cat release-plan-stderr.txt)
-          else
-            release_plan_output=$(jq .description .release-plan.json -r)
-            rm release-plan-stderr.txt
-
-            if [ $(jq '.solution | length' .release-plan.json) -eq 1 ]; then
-              new_version=$(jq -r '.solution[].newVersion' .release-plan.json)
-              echo "new_version=v$new_version" >> $GITHUB_OUTPUT
-            fi
-          fi
-            echo 'text<<EOF' >> $GITHUB_OUTPUT
-          echo "$release_plan_output" >> $GITHUB_OUTPUT
-            echo 'EOF' >> $GITHUB_OUTPUT
         env:
           GITHUB_AUTH: ${{ secrets.GITHUB_TOKEN }}
+        id: explanation
 
       # this is needed because our fixtures are highly dependent on the exact version of ember-cli in the monorepo
       # and release-plan updates the version during the plan phase
@@ -90,12 +53,14 @@ jobs:
         run: |
           sed -i 's/"ember-cli".*/"ember-cli": "~'$(jq -r .version package.json)'",/' packages/app-blueprint/files/package.json
 
-      - uses: peter-evans/create-pull-request@v7
+      - uses: peter-evans/create-pull-request@v8
+        name: Create Prepare Release PR
         with:
-          commit-message: "Prepare Alpha Release ${{ steps.explanation.outputs.new_version}} using 'release-plan'"
+          commit-message: "Prepare Alpha Release ${{ steps.explanation.outputs.new-version}} using 'release-plan'"
           labels: "internal"
+          sign-commits: true
           branch: releaseplan-preview
-          title: Prepare Alpha Release ${{ steps.explanation.outputs.new_version }}
+          title: Prepare Alpha Release ${{ steps.explanation.outputs.new-version }}
           # this doesn't use secrets.GITHUB_TOKEN because we want CI to run on the PR that it opens.
           # See: https://docs.github.com/en/actions/how-tos/security-for-github-actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow
           token: ${{ secrets.RELEASE_PLAN_GH_PAT }}

diff --git a/.github/workflows/plan-beta-release.yml b/.github/workflows/plan-beta-release.yml
@@ -8,78 +8,41 @@ on:
     types:
       - labeled
       - unlabeled
-    branches:
-      - beta
 
 concurrency:
   group: plan-release-beta # only the latest one of these should ever be running
   cancel-in-progress: true
 
 jobs:
-  is-this-a-release:
-    name: "Is this a release?"
+  should-run-release-plan-prepare:
+    name: Should we run release-plan prepare?
     runs-on: ubuntu-latest
     outputs:
-      command: ${{ steps.check-release.outputs.command }}
-
+      should-prepare: ${{ steps.should-prepare.outputs.should-prepare }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: release-plan/actions/should-prepare-release@v1
         with:
-          fetch-depth: 2
           ref: "beta"
-      # This will only cause the `is-this-a-release` job to have a "command" of `release`
-      # when the .release-plan.json file was changed on the last commit.
-      - id: check-release
-        run: if git diff --name-only HEAD HEAD~1 | grep -w -q ".release-plan.json"; then echo "command=release"; fi >> $GITHUB_OUTPUT
+        id: should-prepare
 
   create-prepare-release-pr:
     name: Create Prepare Release PR
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: is-this-a-release
+    needs: should-run-release-plan-prepare
     permissions:
       contents: write
       issues: read
       pull-requests: write
-    # only run on push event or workflow dispatch if plan wasn't updated (don't create a release plan when we're releasing)
-    # only run on labeled event if the PR has already been merged
-    if: ((github.event_name == 'push' || github.event_name == 'workflow_dispatch') && needs.is-this-a-release.outputs.command != 'release') || (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true)
-
+    if: needs.should-run-release-plan-prepare.outputs.should-prepare == 'true'
     steps:
-      - uses: actions/checkout@v4
-        # We need to download lots of history so that
-        # github-changelog can discover what's changed since the last release
+      - uses: release-plan/actions/prepare@v1
+        name: Run release-plan prepare
         with:
-          fetch-depth: 0
           ref: "beta"
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - name: "Generate Explanation and Prep Changelogs"
-        id: explanation
-        run: |
-          set +e
-          pnpm release-plan prepare 2> >(tee -a release-plan-stderr.txt >&2)
-
-          if [ $? -ne 0 ]; then
-            release_plan_output=$(cat release-plan-stderr.txt)
-          else
-            release_plan_output=$(jq .description .release-plan.json -r)
-            rm release-plan-stderr.txt
-
-            if [ $(jq '.solution | length' .release-plan.json) -eq 1 ]; then
-              new_version=$(jq -r '.solution[].newVersion' .release-plan.json)
-              echo "new_version=v$new_version" >> $GITHUB_OUTPUT
-            fi
-          fi
-            echo 'text<<EOF' >> $GITHUB_OUTPUT
-          echo "$release_plan_output" >> $GITHUB_OUTPUT
-            echo 'EOF' >> $GITHUB_OUTPUT
         env:
           GITHUB_AUTH: ${{ secrets.GITHUB_TOKEN }}
+        id: explanation
 
       # this is needed because our fixtures are highly dependent on the exact version of ember-cli in the monorepo
       # and release-plan updates the version during the plan phase
@@ -89,12 +52,14 @@ jobs:
         run: |
           sed -i 's/"ember-cli".*/"ember-cli": "~'$(jq -r .version package.json)'",/' packages/app-blueprint/files/package.json
 
-      - uses: peter-evans/create-pull-request@v7
+      - uses: peter-evans/create-pull-request@v8
+        name: Create Prepare Release PR
         with:
-          commit-message: "Prepare Beta Release ${{ steps.explanation.outputs.new_version}} using 'release-plan'"
+          commit-message: "Prepare Beta Release ${{ steps.explanation.outputs.new-version}} using 'release-plan'"
           labels: "internal"
+          sign-commits: true
           branch: release-preview-beta
-          title: Prepare Beta Release ${{ steps.explanation.outputs.new_version }}
+          title: Prepare Beta Release ${{ steps.explanation.outputs.new-version }}
           # this doesn't use secrets.GITHUB_TOKEN because we want CI to run on the PR that it opens.
           # See: https://docs.github.com/en/actions/how-tos/security-for-github-actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow
           token: ${{ secrets.RELEASE_PLAN_GH_PAT }}

diff --git a/.github/workflows/plan-stable-release.yml b/.github/workflows/plan-stable-release.yml
@@ -8,78 +8,41 @@ on:
     types:
       - labeled
       - unlabeled
-    branches:
-      - release
 
 concurrency:
   group: plan-release-stable # only the latest one of these should ever be running
   cancel-in-progress: true
 
 jobs:
-  is-this-a-release:
-    name: "Is this a release?"
+  should-run-release-plan-prepare:
+    name: Should we run release-plan prepare?
     runs-on: ubuntu-latest
     outputs:
-      command: ${{ steps.check-release.outputs.command }}
-
+      should-prepare: ${{ steps.should-prepare.outputs.should-prepare }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: release-plan/actions/should-prepare-release@v1
         with:
-          fetch-depth: 2
           ref: "release"
-      # This will only cause the `is-this-a-release` job to have a "command" of `release`
-      # when the .release-plan.json file was changed on the last commit.
-      - id: check-release
-        run: if git diff --name-only HEAD HEAD~1 | grep -w -q ".release-plan.json"; then echo "command=release"; fi >> $GITHUB_OUTPUT
+        id: should-prepare
 
   create-prepare-release-pr:
     name: Create Prepare Release PR
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: is-this-a-release
+    needs: should-run-release-plan-prepare
     permissions:
       contents: write
       issues: read
       pull-requests: write
-    # only run on push event or workflow dispatch if plan wasn't updated (don't create a release plan when we're releasing)
-    # only run on labeled event if the PR has already been merged
-    if: ((github.event_name == 'push' || github.event_name == 'workflow_dispatch') && needs.is-this-a-release.outputs.command != 'release') || (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true)
-
+    if: needs.should-run-release-plan-prepare.outputs.should-prepare == 'true'
     steps:
-      - uses: actions/checkout@v4
-        # We need to download lots of history so that
-        # github-changelog can discover what's changed since the last release
+      - uses: release-plan/actions/prepare@v1
+        name: Run release-plan prepare
         with:
-          fetch-depth: 0
           ref: "release"
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - name: "Generate Explanation and Prep Changelogs"
-        id: explanation
-        run: |
-          set +e
-          pnpm release-plan prepare 2> >(tee -a release-plan-stderr.txt >&2)
-
-          if [ $? -ne 0 ]; then
-            release_plan_output=$(cat release-plan-stderr.txt)
-          else
-            release_plan_output=$(jq .description .release-plan.json -r)
-            rm release-plan-stderr.txt
-
-            if [ $(jq '.solution | length' .release-plan.json) -eq 1 ]; then
-              new_version=$(jq -r '.solution[].newVersion' .release-plan.json)
-              echo "new_version=v$new_version" >> $GITHUB_OUTPUT
-            fi
-          fi
-            echo 'text<<EOF' >> $GITHUB_OUTPUT
-          echo "$release_plan_output" >> $GITHUB_OUTPUT
-            echo 'EOF' >> $GITHUB_OUTPUT
         env:
           GITHUB_AUTH: ${{ secrets.GITHUB_TOKEN }}
+        id: explanation
 
       # this is needed because our fixtures are highly dependent on the exact version of ember-cli in the monorepo
       # and release-plan updates the version during the plan phase
@@ -89,12 +52,14 @@ jobs:
         run: |
           sed -i 's/"ember-cli".*/"ember-cli": "~'$(jq -r .version package.json)'",/' packages/app-blueprint/files/package.json
 
-      - uses: peter-evans/create-pull-request@v7
+      - uses: peter-evans/create-pull-request@v8
+        name: Create Prepare Release PR
         with:
-          commit-message: "Prepare Stable Release ${{ steps.explanation.outputs.new_version}} using 'release-plan'"
+          commit-message: "Prepare Alpha Release ${{ steps.explanation.outputs.new-version}} using 'release-plan'"
           labels: "internal"
+          sign-commits: true
           branch: release-preview-stable
-          title: Prepare Stable Release ${{ steps.explanation.outputs.new_version }}
+          title: Prepare Alpha Release ${{ steps.explanation.outputs.new-version }}
           # this doesn't use secrets.GITHUB_TOKEN because we want CI to run on the PR that it opens.
           # See: https://docs.github.com/en/actions/how-tos/security-for-github-actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow
           token: ${{ secrets.RELEASE_PLAN_GH_PAT }}

diff --git a/.github/workflows/publish-beta.yml b/.github/workflows/publish-beta.yml