Update main for TS7 tagged releases

.github/workflows/create-cherry-pick-pr.yml

@@ -56,6 +56,15 @@ jobs:
           filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/
           fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none.
           persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - uses: ./.github/actions/setup-go
+      - name: Check out target branch
+        env:
+          TARGET_BRANCH: ${{ inputs.target_branch }}
+        run: git switch --detach "origin/$TARGET_BRANCH"
+      - run: npm ci
       - uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
         with:
           client-id: ${{ vars.AZURE_CLIENT_ID }}
@@ -110,15 +119,16 @@ jobs:
               pull_number: +PR,
             });
 
-            if (!pr.data.merge_commit_sha) throw new Error("No merge commit sha found");
+            if (!pr.data.merged || !pr.data.merge_commit_sha) {
+              throw new Error(`PR #${PR} has not been merged`);
+            }
 
             const pickBranch = `cherry-pick/${PR}/${TARGET_BRANCH}`;
 
             const title = `🤖 Pick PR #${PR} (${pr.data.title.substring(0, 35)}${pr.data.title.length > 35 ? "..." : ""}) into ${TARGET_BRANCH}`;
 
             await exec.exec("git", ["config", "user.email", "290192711+typescript-automation[bot]@users.noreply.github.com"]);
             await exec.exec("git", ["config", "user.name", "typescript-automation[bot]"]);
-            await exec.exec("git", ["switch", "--detach", `origin/${TARGET_BRANCH}`]);
             await exec.exec("git", ["switch", "-c", pickBranch]);
 
             let updatedBaselinesMessage = "";
@@ -127,29 +137,38 @@ jobs:
             } catch (e) {
               console.log(e);
 
-              // The cherry-pick failed. If all of the conflicts are in tsc/testdata/baselines,
+              // The cherry-pick failed. If all conflicts are compiler baselines,
               // try to run the tests and accept the new baselines.
 
-              await exec.exec("git", ["add", "tsc/testdata/baselines"]);
-              // This will fail if any other files were modified.
-              await exec.exec("git", ["-c", "core.editor=true", "cherry-pick", "--continue"]);
+              const conflictsOutput = await exec.getExecOutput("git", ["diff", "--name-only", "--diff-filter=U"]);
+              const conflictedFiles = conflictsOutput.stdout.trim().split("\n").filter(Boolean);
+              const baselineDirs = ["tsc/testdata/baselines", "tests/baselines"];
+              if (!conflictedFiles.length || conflictedFiles.some(file => !baselineDirs.some(dir => file.startsWith(`${dir}/`)))) {
+                throw new Error(`Cherry-pick has non-baseline conflicts:\n${conflictedFiles.join("\n")}`);
+              }
 
-              await exec.exec("npm", ["ci"]);
+              await exec.exec("git", ["add", "--all", "--", ...conflictedFiles]);
+              await exec.exec("git", ["-c", "core.editor=true", "cherry-pick", "--continue"]);
 
               try {
-                await exec.exec("npm", ["test", "--", "--no-lint"]);
+                await exec.exec("npx", ["hereby", "test"]);
               } catch {
                 // Expected to fail.
               }
 
               await exec.exec("npx", ["hereby", "baseline-accept"]);
-              await exec.exec("git", ["add", "tsc/testdata/baselines"]);
-              await exec.exec("git", ["commit", "-m", "Update baselines"]);
+              await exec.exec("npx", ["hereby", "test"]);
+              const existingBaselineDirs = baselineDirs.filter(dir => conflictedFiles.some(file => file.startsWith(`${dir}/`)));
+              await exec.exec("git", ["add", "--all", "--", ...existingBaselineDirs]);
+              const staged = await exec.getExecOutput("git", ["diff", "--cached", "--quiet"], { ignoreReturnCode: true });
+              if (staged.exitCode !== 0) {
+                await exec.exec("git", ["commit", "-m", "Update baselines"]);
+              }
 
               updatedBaselinesMessage = " This involved updating baselines; please check the diff.";
             }
 
-            await exec.exec("git", ["push", "--force", "--set-upstream", "origin", pickBranch]);
+            await exec.exec("git", ["push", "--force-with-lease", "--set-upstream", "origin", pickBranch]);
 
             const existingPulls = await github.rest.pulls.list({
               owner: context.repo.owner,
@@ -180,11 +199,12 @@ jobs:
                 assignees: ["DanielRosenwasser"],
               });
 
+              const reviewers = ["DanielRosenwasser", REQUESTING_USER].filter(Boolean);
               await github.rest.pulls.requestReviewers({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 pull_number: newPr.data.number,
-                reviewers: ["DanielRosenwasser", REQUESTING_USER],
+                reviewers,
               });
 
               commentBody = `I've created #${newPr.data.number} for you.${updatedBaselinesMessage}`;

.github/disabled-workflows/new-release-branch.yaml → .github/workflows/new-release-branch.yaml

@@ -1,4 +1,4 @@
-name: New Release Branch
+name: New release branch
 
 on:
   workflow_dispatch:
@@ -40,56 +40,74 @@ permissions:
   contents: read
   id-token: write
 
-# Ensure scripts are run with pipefail. See:
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
 defaults:
   run:
     shell: bash
 
 jobs:
-  build:
+  create:
+    if: github.repository == 'microsoft/TypeScript'
     runs-on: ubuntu-latest
     environment:
       name: azure
       deployment: false
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/
-          fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none.
+          ref: main
+          filter: blob:none
+          fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
-      - run: |
-          npm --version
-          # corepack enable npm
-          npm install -g $(jq -r '.packageManager' < package.json)
-          npm --version
-      - env:
+          node-version: 24
+      - uses: ./.github/actions/setup-go
+      - name: Configure release branch
+        env:
           BRANCH_NAME: ${{ inputs.branch_name }}
           PACKAGE_VERSION: ${{ inputs.package_version }}
           CORE_MAJOR_MINOR: ${{ inputs.core_major_minor }}
         run: |
-          git checkout -b "$BRANCH_NAME"
-          sed -i -e 's/"version": ".*"/"version": "'"$PACKAGE_VERSION"'"/g' package.json
-          sed -i -e 's/const versionMajorMinor = ".*"/const versionMajorMinor = "'"$CORE_MAJOR_MINOR"'"/g' src/compiler/corePublic.ts
-          sed -i -e 's/const versionMajorMinor = ".*"/const versionMajorMinor = "'"$CORE_MAJOR_MINOR"'"/g' tests/baselines/reference/api/typescript.d.ts
-          sed -i -e 's/const version\(: string\)\{0,1\} = .*;/const version = "'"$PACKAGE_VERSION"'" as string;/g' src/compiler/corePublic.ts
-          npm ci
-          npm install # update package-lock.json to ensure the version bump is included
-          npx hereby LKG
-          npm test
-          git diff
-          git add package.json package-lock.json
-          git add src/compiler/corePublic.ts
-          git add tests/baselines/reference/api/typescript.d.ts
-          git add --force ./lib
+          set -euo pipefail
+          if ! [[ "$BRANCH_NAME" =~ ^(release-.+|ts[0-9]+-release)$ ]]; then
+            echo "Release branch name must start with 'release-' or match 'ts<number>-release'." >&2
+            exit 1
+          fi
+          if git show-ref --verify --quiet "refs/remotes/origin/$BRANCH_NAME"; then
+            echo "Branch $BRANCH_NAME already exists." >&2
+            exit 1
+          fi
+
+          git switch -c "$BRANCH_NAME"
+          node tools/scripts/configure-release.mjs "$PACKAGE_VERSION" "$CORE_MAJOR_MINOR"
+
+          mapfile -t changedFiles < <(git diff --name-only)
+          expectedFiles=("Herebyfile.mjs" "tsc/internal/core/version.go")
+          if [ "${changedFiles[*]}" != "${expectedFiles[*]}" ]; then
+            echo "Unexpected files in release configuration: ${changedFiles[*]}" >&2
+            exit 1
+          fi
+      - run: npm ci
+      - run: npx hereby validate --all
+      - name: Commit release configuration
+        env:
+          PACKAGE_VERSION: ${{ inputs.package_version }}
+        run: |
+          set -euo pipefail
+          git diff --check
+          mapfile -t changedFiles < <(git diff --name-only)
+          expectedFiles=("Herebyfile.mjs" "tsc/internal/core/version.go")
+          if [ "${changedFiles[*]}" != "${expectedFiles[*]}" ]; then
+            echo "Validation produced unexpected changes: ${changedFiles[*]}" >&2
+            exit 1
+          fi
+          git add Herebyfile.mjs tsc/internal/core/version.go
           git config user.email "290192711+typescript-automation[bot]@users.noreply.github.com"
           git config user.name "typescript-automation[bot]"
-          git commit -m "Bump version to $PACKAGE_VERSION and LKG"
-      - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
+          git config core.hooksPath /dev/null
+          git commit -m "Bump version to $PACKAGE_VERSION"
+      - uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
         with:
           client-id: ${{ vars.AZURE_CLIENT_ID }}
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -104,7 +122,6 @@ jobs:
           repositories: TypeScript
           permission-contents: write
       - name: Configure git for GitHub App token
-        shell: bash
         env:
           GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |