fix: skip notarization/native builds when not publishing

.github/workflows/codeql.yaml

@@ -0,0 +1,95 @@
+name: CodeQL Analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # weekly scan — Sundays at 4am UTC
+    - cron: '0 4 * * 0'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze-js:
+    name: Analyze JavaScript/TypeScript + Actions
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        language: [javascript-typescript, actions]
+    steps:
+      - uses: actions/checkout@v6
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          config-file: ./.github/codeql/codeql-config.yml
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: ${{ matrix.language }}
+
+  check-native-changes:
+    name: Check native source changes
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    outputs:
+      swift-changed: ${{ steps.check.outputs.swift-changed }}
+      rust-changed: ${{ steps.check.outputs.rust-changed }}
+    steps:
+      - id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          FILES=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files --paginate --jq '.[].filename')
+          if echo "$FILES" | grep -q '^packages/encryption-binary-swift/'; then
+            echo "swift-changed=true" >> $GITHUB_OUTPUT
+          else
+            echo "swift-changed=false" >> $GITHUB_OUTPUT
+          fi
+          if echo "$FILES" | grep -q '^packages/encryption-binary-rust/'; then
+            echo "rust-changed=true" >> $GITHUB_OUTPUT
+          else
+            echo "rust-changed=false" >> $GITHUB_OUTPUT
+          fi
+
+  analyze-swift:
+    name: Analyze Swift
+    needs: check-native-changes
+    if: always() && (github.event_name != 'pull_request' || needs.check-native-changes.outputs.swift-changed == 'true')
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: swift
+          config-file: ./.github/codeql/codeql-config.yml
+      - name: Build Swift binary
+        run: |
+          cd packages/encryption-binary-swift
+          swift build
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: swift
+
+  analyze-rust:
+    name: Analyze Rust
+    needs: check-native-changes
+    if: always() && (github.event_name != 'pull_request' || needs.check-native-changes.outputs.rust-changed == 'true')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: rust
+          config-file: ./.github/codeql/codeql-config.yml
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: rust

.github/workflows/release.yaml

@@ -8,11 +8,30 @@ on:
 permissions:
   contents: read
 
-concurrency: ${{ github.workflow }}-${{ github.ref }}
+concurrency:
+  group: bumpy-release
+  cancel-in-progress: false
 
 jobs:
+  # Determine what bumpy will do — only run expensive build/notarize when publishing
+  plan:
+    runs-on: ubuntu-latest
+    outputs:
+      mode: ${{ steps.plan.outputs.mode }}
+      includes-varlock: ${{ contains(fromJSON(steps.plan.outputs.json).packageNames, 'varlock') }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+      - id: plan
+        run: bunx @varlock/bumpy ci plan
+        env:
+          GH_TOKEN: ${{ github.token }}
+
   # Build and sign the macOS native binary (cache hit if already built in CI)
   build-native-macos:
+    needs: plan
+    if: needs.plan.outputs.mode == 'publish' && needs.plan.outputs.includes-varlock == 'true'
     uses: ./.github/workflows/build-native-macos.yaml
     with:
       mode: release
@@ -22,7 +41,8 @@ jobs:
 
   # Notarize for production npm distribution
   notarize-native-macos:
-    needs: build-native-macos
+    needs: [plan, build-native-macos]
+    if: needs.plan.outputs.mode == 'publish' && needs.plan.outputs.includes-varlock == 'true'
     uses: ./.github/workflows/notarize-native-macos.yaml
     with:
       source-artifact-name: native-bin-macos-signed
@@ -32,13 +52,16 @@ jobs:
 
   # Build Rust native binaries for Linux and Windows
   build-native-rust:
+    needs: plan
+    if: needs.plan.outputs.mode == 'publish' && needs.plan.outputs.includes-varlock == 'true'
     uses: ./.github/workflows/build-native-rust.yaml
     with:
       artifact-name: native-bin-rust
 
   release:
     name: Release
-    needs: [notarize-native-macos, build-native-rust]
+    needs: [plan, notarize-native-macos, build-native-rust]
+    if: always() && !failure() && !cancelled()
     runs-on: ubuntu-latest
     permissions:
       id-token: write  # Required for OIDC
@@ -77,30 +100,36 @@ jobs:
 
       # Download signed macOS native binary so it's included in the npm package
       - name: Download macOS native binary
+        if: needs.plan.outputs.mode == 'publish' && needs.plan.outputs.includes-varlock == 'true'
         uses: actions/download-artifact@v8
         with:
           name: native-bin-macos-npm
           path: packages/varlock/native-bins/darwin/VarlockEnclave.app
       - name: Restore native binary execute permission
+        if: needs.plan.outputs.mode == 'publish' && needs.plan.outputs.includes-varlock == 'true'
         run: chmod +x packages/varlock/native-bins/darwin/VarlockEnclave.app/Contents/MacOS/varlock-local-encrypt
 
       # Download Rust native binaries for Linux and Windows
       - name: Download Linux x64 native binary
+        if: needs.plan.outputs.mode == 'publish' && needs.plan.outputs.includes-varlock == 'true'
         uses: actions/download-artifact@v8
         with:
           name: native-bin-rust-linux-x64
           path: packages/varlock/native-bins/linux-x64
       - name: Download Linux arm64 native binary
+        if: needs.plan.outputs.mode == 'publish' && needs.plan.outputs.includes-varlock == 'true'
         uses: actions/download-artifact@v8
         with:
           name: native-bin-rust-linux-arm64
           path: packages/varlock/native-bins/linux-arm64
       - name: Download Windows x64 native binary
+        if: needs.plan.outputs.mode == 'publish' && needs.plan.outputs.includes-varlock == 'true'
         uses: actions/download-artifact@v8
         with:
           name: native-bin-rust-win32-x64
           path: packages/varlock/native-bins/win32-x64
       - name: Restore Rust binary execute permissions
+        if: needs.plan.outputs.mode == 'publish' && needs.plan.outputs.includes-varlock == 'true'
         run: |
           chmod +x packages/varlock/native-bins/linux-x64/varlock-local-encrypt
           chmod +x packages/varlock/native-bins/linux-arm64/varlock-local-encrypt

package.json

@@ -30,7 +30,7 @@
     "prepare": "lefthook install"
   },
   "devDependencies": {
-    "@varlock/bumpy": "^1.5.1",
+    "@varlock/bumpy": "^1.7.0",
     "@cloudflare/vite-plugin": "^1.30.1",
     "@eslint/js": "^10.0.1",
     "@stylistic/eslint-plugin": "^5.9.0",

scripts/check-release-packages.ts

@@ -37,7 +37,7 @@ if (bumpyStatusRaw) {
   if (jsonMatch) {
     const bumpyStatus = JSON.parse(jsonMatch[0]);
     const bumpyReleases = bumpyStatus.releases
-      .filter((r: any) => r.publishTargets?.includes('npm'));
+      .filter((r: any) => r.publishTargets?.some((t: any) => t.type === 'npm'));
     releasePackagePaths = bumpyReleases
       .map((r: any) => path.resolve(MONOREPO_ROOT, r.dir));
   }