ci: switch publishing to npm Trusted Publishing, drop pinax infra

.changeset/drop-node-20.md

@@ -0,0 +1,7 @@
+---
+'@graphprotocol/graph-cli': minor
+---
+
+Drop support for Node.js 20 (end-of-life 2026-04-30). The minimum supported
+Node.js version is now 22.11.0 (Node 22 LTS). CI now tests on Node 22 and 24;
+released binaries continue to be built on Node 24.

.github/actions/setup-node/action.yml

@@ -7,7 +7,7 @@ inputs:
   nodeVersion:
     description: Node.js version to use
     required: true
-    default: '20'
+    default: '22'
   workingDirectory:
     description: Working directory
     required: false
@@ -24,12 +24,6 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Cancel Previous Runs
-      uses: styfle/cancel-workflow-action@0.12.1
-      continue-on-error: true
-      with:
-        access_token: ${{ github.token }}
-
     - name: check pnpm version
       shell: bash
       id: pnpm
@@ -50,7 +44,7 @@ runs:
     - name: Setup ${{ inputs.packageManager }}
       id: pnpm_setup
       if: inputs.packageManager == 'pnpm'
-      uses: pnpm/action-setup@v4.2.0
+      uses: pnpm/action-setup@v6
       with:
         version: ${{ steps.pnpm.outputs.version }}
         run_install: false

.github/workflows/changeset-deps.yml

@@ -0,0 +1,32 @@
+name: Auto changesets for dep updates
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: changeset-deps-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  changeset:
+    name: Add changeset for dep bump
+    if: |
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login == 'renovate[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          fetch-depth: 0
+
+      - name: Add changeset
+        uses: mscharley/dependency-changesets-action@v1.2.4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yml

@@ -7,6 +7,10 @@ on:
       - 'main'
   pull_request:
 
+concurrency:
+  group: tests-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   lint:
     name: Lint
@@ -20,7 +24,7 @@ jobs:
       - uses: ./.github/actions/setup-node
         name: Setup Env
         with:
-          nodeVersion: 20
+          nodeVersion: 22
           packageManager: pnpm
           packageManagerVersion: 9
 
@@ -34,7 +38,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [20, 22]
+        node-version: [22, 24]
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v5
@@ -76,7 +80,7 @@ jobs:
       - uses: ./.github/actions/setup-node
         name: Setup Env
         with:
-          nodeVersion: 20
+          nodeVersion: 22
           packageManager: pnpm
           packageManagerVersion: 9
 
@@ -106,7 +110,7 @@ jobs:
       - uses: ./.github/actions/setup-node
         name: Setup Env
         with:
-          nodeVersion: 20
+          nodeVersion: 22
           packageManager: pnpm
           packageManagerVersion: 9
 

.github/workflows/publish.yml

@@ -0,0 +1,135 @@
+name: Publish
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+env:
+  RELEASE_COMMIT_MSG: 'chore(release): update monorepo packages versions'
+
+jobs:
+  stable:
+    name: Stable
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    concurrency:
+      group: publish-stable
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Setup environment
+        uses: ./.github/actions/setup-node
+        with:
+          nodeVersion: 24
+          packageManager: pnpm
+          packageManagerVersion: 9
+
+      - name: Build
+        if: ${{ startsWith(github.event.head_commit.message, env.RELEASE_COMMIT_MSG) }}
+        run: pnpm --filter=@graphprotocol/graph-cli build
+
+      - name: Pack binaries
+        if: ${{ startsWith(github.event.head_commit.message, env.RELEASE_COMMIT_MSG) }}
+        run: pnpm --filter=@graphprotocol/graph-cli oclif:pack
+
+      - name: Create Release PR or Publish
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          publish: pnpm release
+          version: pnpm changeset version
+          commit: ${{ env.RELEASE_COMMIT_MSG }}
+          title: Upcoming Release Changes
+          createGithubReleases: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: 'true'
+
+      - name: Attach oclif binaries to GitHub Release
+        if: steps.changesets.outputs.published == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PUBLISHED: ${{ steps.changesets.outputs.publishedPackages }}
+        run: |
+          tag=$(jq -r '.[] | select(.name == "@graphprotocol/graph-cli") | "\(.name)@\(.version)"' <<< "$PUBLISHED")
+          if [ -n "$tag" ]; then
+            gh release upload "$tag" packages/cli/dist/*.tar.gz --clobber
+          fi
+
+  snapshot:
+    name: Snapshot
+    if: |
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    concurrency:
+      group: publish-snapshot-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Setup environment
+        uses: ./.github/actions/setup-node
+        with:
+          nodeVersion: 24
+          packageManager: pnpm
+          packageManagerVersion: 9
+
+      - name: Determine snapshot tag
+        id: tag
+        run: |
+          if [ "${{ github.event.pull_request.title }}" = "Upcoming Release Changes" ]; then
+            echo "tag=rc" >> "$GITHUB_OUTPUT"
+            # rc snapshots are taken from the Version PR — restore deleted changesets
+            git checkout HEAD~1 -- .changeset
+          else
+            echo "tag=alpha" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check for changesets
+        id: has_changesets
+        run: |
+          if ls .changeset/*.md 2>/dev/null | grep -v README | grep -q .; then
+            echo "has=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build
+        if: steps.has_changesets.outputs.has == 'true'
+        run: pnpm build
+
+      - name: Snapshot version
+        if: steps.has_changesets.outputs.has == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: pnpm changeset version --snapshot ${{ steps.tag.outputs.tag }}
+
+      - name: Publish snapshot
+        if: steps.has_changesets.outputs.has == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: 'true'
+        run: pnpm changeset publish --tag ${{ steps.tag.outputs.tag }} --no-git-tag