Repository navigation
ci(release): publish from CI with trusted publishing, one tag and release - #41
Merged
Merged
Conversation
…ease The Changesets action now only opens the release PR. After it merges, a publish job waits for the npm-publish environment's approval, then scripts/publish-ci.ts smoke-tests the packed tarballs, publishes exactly those with npm trusted publishing (OIDC, provenance), waits until npm serves all 13, and creates one vX.Y.Z tag and GitHub Release with notes built from the changelogs (dependency-only lines dropped). Re-runs skip what is already done. Top-level permissions are empty, third-party actions are pinned by SHA. Still gated by RELEASE_ENABLED. CONTRIBUTING gains a Releasing section. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Madraka <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves releases from the maintainer's laptop to CI (internal release-process review, decisions of 2026-10-21).
Flow (
.github/workflows/release.yml, still gated byRELEASE_ENABLED)version: the Changesets action opens/updates the release PR. No publishing here.plan: after the merge,publish-ci.ts --planasks npm which of the 13 packages lack the new version.publish: waits for thenpm-publishenvironment (required reviewer: the maintainer; branchmainonly, both already configured), thenscripts/publish-ci.ts:build-packages --check, thensmoke-pack.ts --tarballs: build, pack, install from scratch with npm,cloudhal dev,deploy --dry-run;npm publish <tarball> --provenancefor exactly those tarballs, npm 12, trusted publishing (OIDC),--ignore-scripts;vX.Y.Ztag and one GitHub Release, notes from the changelogs without dependency-only lines.Re-runs skip what npm already has and an existing tag/release.
Hardening: top-level
permissions: {}, per-job grants, third-party actions pinned by SHA,persist-credentials: falsewhere no push is needed.Before turning it on (maintainer): trusted-publisher entries on npmjs.com for the 13 packages; allow GitHub Actions to create PRs (org + repo); then
RELEASE_ENABLED=true. 0.3.5 is the first CI release.Tests:
packages/cli/test/release-plan.test.ts(fixed-group version, publish order, release notes). CONTRIBUTING: new "Releasing" section.🤖 Generated with Claude Code