ci: release to npm on tag push (trusted publishing, mirrors kernel/cua)

[masnwilliams]

Summary

The repo had no release/publish flow — only ci.yml (build/typecheck/pack on PRs), and the package isn't on npm yet. This adds a release.yml that publishes @onkernel/eve-extension to npm on a v* tag push.

Modeled on the kernel/cua release workflows (release-cua-ai.yml etc.), collapsed to a single package:

• Tag-push trigger (v*), not a GitHub Release.
• OIDC trusted publishing — id-token: write + npm@^11.5.1, npm publish with no npm token. (Confirmed working in practice: @onkernel/cua-ai@latest is published by GitHub Actions via trustedPublisher: github using this exact shape.)
• Guards: tag must be an ancestor of main, and package.json version must equal the tag (v<version>).
• Pre-publish gate: build → typecheck → npm pack → ESM-import smoke test (installs the tarball + the eve peer and imports the default export).
• Node 24 to match engines.node.

One-time bootstrap (required — package is new)

OIDC trusted publishing can't perform the first publish of a package that doesn't exist yet (you can't configure a trusted publisher on a non-existent package). kernel/cua hit the same wall — hence its bootstrap: 0.0.1 dist-tag. So before the first CI release, a maintainer with @onkernel publish rights does a one-time manual publish, then wires trusted publishing:

# local, one-time, with an @onkernel-scoped npm token or `npm login`
npm version 0.0.1 --no-git-tag-version
npm publish --access public --tag bootstrap    # creates the package without taking `latest`
git checkout package.json                        # discard the temp 0.0.1 bump

Then in the npm package settings → Trusted Publisher → GitHub Actions, repo kernel/eve-extension, workflow release.yml. After that, every real release goes through CI over OIDC — no token.

How to release (steady state)

1. Bump version in package.json, merge to main.
2. Tag the merge commit v<version> (e.g. v0.1.0) and push the tag → workflow builds, verifies, and publishes latest.

Bugbot findings

• "OIDC blocked by registry-url" (high) — false positive. @onkernel/cua-ai@0.7.0 publishes via OIDC with registry-url set and no token; npm ≥11.5.1 ignores the empty _authToken and engages OIDC.
• "First publish impossible via OIDC" (high) — valid. Addressed operationally via the one-time bootstrap above (same as cua), not a workflow change.

Verified locally (Node 24)

• npm ci → prepare builds dist/ cleanly; npm run typecheck passes
• npm pack → 13 files (dist + README + LICENSE + package.json, 20.9 kB unpacked)
• ESM import smoke: installed the packed tarball + eve@^0.25, import('@onkernel/eve-extension') resolves and default is a function

---

Note

Medium Risk
Adds automated public npm publishing with supply-chain gates, but a mis-tagged or wrongly configured trusted publisher could still ship a bad release; operational one-time bootstrap is required before OIDC can publish a new package.

Overview
Introduces .github/workflows/release.yml, a release pipeline that runs when a v* tag is pushed.

The job enforces that the tagged commit is on main and that package.json version matches the tag (without the v prefix), then runs npm ci, build, typecheck, npm pack, and an ESM smoke test (install tarball + eve peer, import default export) before npm publish --access public.

Publishing uses npm OIDC trusted publishing (id-token: write, global npm ≥11.5.1, no stored npm token) with Node 24 and a per-tag concurrency group so overlapping releases for the same tag do not cancel each other.

^{Reviewed by Cursor Bugbot for commit 062c788. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0fead09. Configure here.}

[cursor]

OIDC publish blocked by registry-url

High Severity

The actions/setup-node step, when configured with registry-url, writes an .npmrc entry for _authToken using an unset NODE_AUTH_TOKEN. This empty token entry then takes precedence, preventing npm's OIDC trusted publishing from engaging, which causes npm publish to fail with ENEEDAUTH.

 

^{Reviewed by Cursor Bugbot for commit 0fead09. Configure here.}

[cursor]

First publish impossible via OIDC

High Severity

The workflow authenticates only via trusted publishing OIDC and never wires NODE_AUTH_TOKEN / NPM_TOKEN. npm still cannot publish the initial version of a package that does not exist yet over OIDC, and this package is not on npm, so the first release cannot succeed.

Additional Locations (1)

• .github/workflows/release.yml#L73-L75

 

^{Reviewed by Cursor Bugbot for commit 0fead09. Configure here.}

[dprevoznik]

LGTM