From dd76331933178bed80241ea59a4a10e134800af8 Mon Sep 17 00:00:00 2001 From: vitalragaz Date: Fri, 18 Sep 2026 11:23:19 +0000 Subject: [PATCH] docs: document the tokenless release path and add a dry_run to manual-publish [AIS-7539] Publishing runs on npm trusted publishing bound to release-please.yml; there are no secrets to rotate and manual-publish.yml cannot authenticate unless that trust is re-pointed. The new dry_run input (default on) makes a manual-publish dispatch a safe proof that checkout, build, version assertion and pack still work from a current maintainer's account. --- .github/workflows/manual-publish.yml | 8 ++++++++ README.md | 10 ++++++++++ 2 files changed, 18 insertions(+) diff --git a/.github/workflows/manual-publish.yml b/.github/workflows/manual-publish.yml index 2fef06f..0640b69 100644 --- a/.github/workflows/manual-publish.yml +++ b/.github/workflows/manual-publish.yml @@ -16,6 +16,10 @@ on: description: "Version package.json MUST declare" required: true default: "0.1.0" + dry_run: + description: "Build, assert and pack the ref without contacting the registry" + type: boolean + default: true jobs: publish: @@ -84,5 +88,9 @@ jobs: run: pnpm install --frozen-lockfile - name: Build run: pnpm build + - name: Pack only (dry run) + if: ${{ inputs.dry_run }} + run: npm publish --dry-run --access public - name: Publish to npm + if: ${{ !inputs.dry_run }} run: npm publish --provenance --access public diff --git a/README.md b/README.md index 22a105d..db4a786 100644 --- a/README.md +++ b/README.md @@ -266,6 +266,16 @@ pnpm docs:generate # rewrite llms.txt, llms-full.txt and docs/ from the CLI node dist/bin.js whoami ``` +## Releasing + +Publishing is tokenless. There are no repository or organization secrets in the release path, and nothing in it is tied to a person. + +- [`release-please.yml`](.github/workflows/release-please.yml) runs on every push to `main`. `feat:` and `fix:` commits accumulate into a release PR; merging that PR tags the release and the `publish` job runs `npm publish --provenance`. +- Authentication is npm [trusted publishing](https://docs.npmjs.com/trusted-publishers) over GitHub Actions OIDC (`id-token: write`). The trust is configured on npmjs.com for `@speechify/cli` and points at this repository and the `release-please.yml` workflow. Viewing or changing it needs an npm maintainer of the package (package Settings, Trusted Publisher). +- npm allows one trusted publisher per package, so [`manual-publish.yml`](.github/workflows/manual-publish.yml) can only publish if that trust is re-pointed at it first. Dispatched with `dry_run` on (the default) it checks out a tag, builds, asserts the version and packs without contacting the registry, which is the way to prove the release path still works. + +Maintainer contact: `devrel@speechify.com`. + ## Architecture `src/program.ts` assembles the commander command tree (side-effect-free) and