Repository navigation
ci: publish from a tag-driven workflow with npm trusted publishing - #200
Merged
Merged
Conversation
Publishing is now a GitHub workflow instead of a local pnpm publish: - Pushing a v* tag triggers publish.yml. The version comes from the tag (v0.6.0 -> 0.6.0, v0.6.0-dev.abc1234 -> 0.6.0-dev.abc1234) and the npm dist-tag is inferred from it: plain versions publish as latest (allowed only from main), -next.* as next, -dev.* as dev, with the short commit hash as the prerelease suffix. - The full Playwright matrix runs first (ci.yml is now callable and gates the publish job). - npm trusted publishing via OIDC: id-token permission + npm@latest, no tokens anywhere. - Build is validated with publint and published from dist/. - changelogithub generates GitHub release notes for latest releases. Replaces release.yml; ci.yml no longer fires directly on tag pushes since publish.yml invokes it.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
justin-schroeder
left a comment
justin-schroeder
left a comment
Member
Author
There was a problem hiding this comment.
Review notes: dist-tag inference regex matches the formkit monorepo's exactly (a version like 1.0.0-devtools.1 would publish as latest — same accepted behavior there; the canonical prerelease channels are -next./-dev.). The latest-branch guard uses 'git branch -r --contains HEAD' with fetch-depth 0, same as the hardened release.yml had. publish runs from dist/ where build.ts writes the public package.json (private stripped, exports rewritten) — verified earlier in #180 that the built manifest is correct. Node pinned to the same verified-good 24.15.0 as ci.yml.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves publishing from local
pnpm publishto a tag-driven GitHub workflow, modeled on how tempo and the formkit monorepo publish.How releasing works now
Push a git tag and the workflow does the rest:
v0.6.00.6.0latest— only allowed from mainv0.6.0-next.abc12340.6.0-next.abc1234nextv0.6.0-dev.abc12340.6.0-dev.abc1234devThe prerelease suffix is the short commit hash.
Pipeline
publish.ymlcallsci.yml(nowworkflow_call-able) — the full 4-shard Playwright matrix must pass before anything publishes.publint, and published fromdist/.id-token: write+npm@latest, noNPM_TOKENanywhere.changelogithubgenerates GitHub release notes forlatestreleases only.Housekeeping
release.ymlis removed (superseded — the npm trusted publisher needs to point atpublish.ymlwhen configured).ci.ymlno longer fires directly on tag pushes (publish.yml invokes it), so a release runs the matrix exactly once.