ci: add tag-triggered npm publish workflow - #19
Open
mgcrea wants to merge 4 commits into
Open
Conversation
Publishes to npm when a semver tag is pushed. Runs the full lint/check/spec/build gate first and fails fast if the tag does not match package.json version. Uses OIDC provenance; requires an NPM_TOKEN repository secret.
pnpm publish accepts --provenance but silently ignores it, which would produce a successful publish with no attestation. npm publish implements provenance via the OIDC token, so use it for the publish step while keeping pnpm for install and the build/test gate.
mgcrea
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
Publish Packageworkflow that publishes to npm when a semver tag is pushed.The only file this PR changes is
.github/workflows/publish.yaml(+55). The scale/opacity/transform changes shown in the diff view are already onmain— they landed via #10, #11 and #17. They appear here only because this branch merged those same feature branches independently ofmain, producing a criss-cross merge base.git diff main <branch>reports one changed file.What the workflow does
Triggered by a pushed semver tag (or manual dispatch):
package.jsonversion, failing fast on mismatchnpm publish --access public --provenanceNotes
npm, notpnpm.pnpm publishaccepts--provenanceand silently ignores it — a dry run exits 0 with no attestation and no warning.npm publishimplements it via the OIDC token.pnpmstill handles install and the test gate.NPM_TOKENrepository secret. Not yet configured; the publish step is last, so without it the run goes green until the final step.permissionsiscontents: read+id-token: write— the latter is what provenance needs; nothing in the job writes to the repo.Before the first release
These merged PRs are all
feat:, and #10 changesscale-999from returningnullto9.99. That makes the next version0.17.0, not a patch. The workflow's version guard will reject a mismatched tag, so bumppackage.jsonbefore tagging.Suggested merge
Squash — this branch carries two stale merge commits whose content is already on
main.