Add workflow to release upgradeable package

.github/workflows/release-upgradeable.yml

@@ -0,0 +1,52 @@
+name: Release Upgradeable
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  release-upgradeable:
+    environment: push-upgradeable
+    permissions:
+      id-token: write # Required for OIDC
+      contents: read
+    runs-on: ubuntu-latest
+    env:
+      VANILLA_REPO: OpenZeppelin/openzeppelin-contracts
+      UPGRADEABLE_REPO: james-toussaint/openzeppelin-contracts-upgradeable # TODO: Update repo before merging
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: ${{ env.UPGRADEABLE_REPO }}
+          submodules: true
+          token: ${{ secrets.GH_TOKEN_UPGRADEABLE }}
+          ref: ${{ github.ref }}
+      - uses: actions/checkout@v5
+        with:
+          repository: ${{ env.VANILLA_REPO }}
+          ref: ${{ github.ref }}
+          path: vanilla
+      - id: vanilla
+        name: Get vanilla commit
+        run: cd vanilla && echo "commit=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+      - uses: actions/checkout@v5 # TODO: Remove this before merging (used to get scripts added in this PR)
+        with:
+          path: vanilla
+      - name: Set up environment
+        uses: ./vanilla/.github/actions/setup
+      - id: check-upgradeable
+        name: Check upgradeable
+        run: bash vanilla/scripts/release/workflow/check-upgradeable.sh
+        env:
+          VANILLA_COMMIT: ${{ steps.vanilla.outputs.commit }}
+      - id: publish
+        name: Publish
+        run: bash vanilla/scripts/release/workflow/publish-upgradeable.sh
+        env:
+          NPM_TAG: ${{ steps.check-upgradeable.outputs.npm_tag }}
+      - name: Create Github Release Note
+        run: bash vanilla/scripts/release/workflow/github-release-upgradeable.sh
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN_UPGRADEABLE }}
+          GIT_TAG: ${{ steps.check-upgradeable.outputs.git_tag }}
+          RELEASE_COMMIT: ${{ steps.check-upgradeable.outputs.release_commit }}
+          PRERELEASE: ${{ steps.check-upgradeable.outputs.prerelease }}

scripts/release/workflow/check-upgradeable.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo "release_commit=$(git log -1 --pretty=%H)" >> "$GITHUB_OUTPUT"
+if ! git log -1 --pretty=%B | grep -q "Transpile ${VANILLA_COMMIT}"; then
+  echo "Expected 'Transpile ${VANILLA_COMMIT}' but found '$(git log -1 --pretty=%B)'"
+  exit 1
+fi
+VERSION="$(jq -r .version contracts/package.json)"
+GIT_TAG="v${VERSION}"
+NPM_TAG="tmp"
+PRERELEASE="true"
+if [[ "${GIT_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  NPM_TAG="dev"
+  PRERELEASE="false"
+elif [[ "${GIT_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-rc.[0-9]+$ ]]; then
+  NPM_TAG="next"
+fi
+echo "prerelease=${PRERELEASE}" >> "$GITHUB_OUTPUT"
+echo "npm_tag=${NPM_TAG}" >> "$GITHUB_OUTPUT"
+### [START BLOCK] TODO: Remove block before merging
+TIMESTAMPED_VERSION="${VERSION}-$(date +%s)"
+echo "OLD_GIT_TAG=${GIT_TAG}" >> "$GITHUB_ENV"
+GIT_TAG="${GIT_TAG}-$(date +%s)" # incremental git tag for testing
+sed -i'' -e 's/openzeppelin\/contracts-upgradeable/james-toussaint\/contracts-upgradeable/g' contracts/package.json # custom scope for testing
+sed -i'' -e "s/${VERSION}/${TIMESTAMPED_VERSION}/g" contracts/package.json && head contracts/package.json # incremental npm package version for testing
+### [END BLOCK]
+echo "git_tag=${GIT_TAG}" >> "$GITHUB_OUTPUT"

scripts/release/workflow/github-release-upgradeable.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+gh release create "${GIT_TAG}" \
+  --repo="${UPGRADEABLE_REPO}" \
+  --title="${GIT_TAG}" \
+  --target="${RELEASE_COMMIT}" \
+  --notes="$(gh release view "${OLD_GIT_TAG}" --repo="${VANILLA_REPO}" --json body -q .body)" `# TODO: Update tag before merging` \
+  --prerelease="${PRERELEASE}"

scripts/release/workflow/publish-upgradeable.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+sed -i'' -e 's/OpenZeppelin\/openzeppelin-contracts-upgradeable/james-toussaint\/openzeppelin-contracts/g' contracts/package.json # repository.url for provenance (TODO: Update and try keep upgradeable url)
+cd "contracts/"
+npm publish --tag "${NPM_TAG}"