chore: set up auto for versioning/release management

[hydrosquall]

Motivation

• Less time spent on managing package infra

Changes

• Replicate the setup in chore: set up auto for versioning/release management  vega-themes#293, + updates documentation

Testing

• CI should pass

Pre-merge checklist for a repo admin

• Create a branch called next from the current head of master
  • make that the base branch of this PR instead of master
  • make next the base branch for the whole repo
• Create a branch called stable from the latest tag v6.18.2 https://github.com/vega/vega-embed/tree/stable
• Make a tagged release of the latest tag (exists, https://github.com/vega/vega-embed/releases/tag/v6.18.2 )
• Create tags called skip-release and released in this repo (the first is used to tell auto not to release anything if this PR is released, the second is used to tag PRs that have been released).
• I'll clean up the git history before merging, leaving it intact for now just so we can keep track of the different debugging steps that were taken. (I can also leave it as-is if we just plan to squash everything on merge anyways).

Debugging Notes

• I was initially getting a cryptic error message about the inability to set the NPM_TOKEN, followed by an authentication error. I tried setting just NPM_TOKEN or NODE_AUTH_TOKEN (which works for all the other repos), but for some reason the command fails unless you use both. Switching back to Node 14 (from the current 15) doesn't seem to make a difference.
• It turns out when you yarn run, it quietly changes the package registry to yarnpkg instead of npmjs (as reported Running a yarn command with yarn sets registry to https://registry.yarnpkg.com yarnpkg/yarn#5854 ). After trying a few different "workarounds" and gradually increasing logging verbosity, I found the most reliable option was to remove yarn from the release command, and using npm run instead of yarn run for this one task.

📦 Published PR as canary version: 6.18.3--canary.749.7906d39.0

✨ Test out this PR locally via:

npm install [email protected]
# or 
yarn add [email protected]

[domoritz]

What is this?

[hydrosquall]

I'll remove the comment. What this did was make sure that the version of node being used with npm and the version used when running npm run SCRIPT_NAME would be the same. I thought this might fix the issue (around needing 2 auth variables to be set), but it unfortunately didn't work.

npm/npm#15398

[domoritz]

Why do we need both?

[hydrosquall]

I unfortunately don't know why this is different in Node 15 (which seems to be the main difference between this repo and the other 4 vega repos we've set this up for. I tested with just one or the other, and it didn't work in either case.

73e34de

[github-actions]

🚀 PR was released in v6.19.0 🚀