Publish NPM packages from CI

[Pessimistress]

Background

After this PR, the publish workflow will be

• Switch to the appropriate branch (master for alpha/beta in development or *-release for production)
• Edit CHANGELOG.md
• Run yarn publish-beta or yarn publish-prod (note: with dash)

The publish command will only bump versions in package.json files, tag the commit and push to remote. The CI will then test, build, and publish to NPM.

As discussed offline, this will remove the differences in local dev environments and ensure predictable results. Also saves us time from working around render test inconsistencies and random errors.

I have tested the version bumping and tagging part of the workflow. Can't verify the CI workflow until merged. May need to follow up with more PRs to fix any CI issues.

Change List

• Bump ocular-dev-tools
• Enforce changelog update before publishing
• Release CI flow

Change List (outside this PR)

• Add npm access token as secret
• Restrict push permission of *-release branches to admins only

[ibgreen]

rubber stamp

[donmccurdy]

Restrict push permission of *-release branches to admins only

Does this affect the publish workflow you described above? If a non-admin is trying to publish a new release on a visgl repository, do we also support a workflow allowing non-admins to cut the release? Example:

1. Create a new branch off the target *-release branch
2. Cherry-pick commits for the new version
3. Run yarn publish-[mode]
4. New branch is pushed to remote
5. Open a PR
6. Wait for review, merge the PR
7. CI publishes the release to npm

The only minor issue I see in that workflow is that Git tags are pushed before the PR is approved and merged, but that isn't necessarily a problem.

[Pessimistress]

My plan is to just manage publish rights by managing push permission to the release branches. If someone is allowed to publish then they will be allowed to push.