ci: publish to npm on tag - #361
Merged
Merged
Conversation
npm publishing has been a manual local step since the beginning, and it kept being forgotten: v0.21, v0.22, v0.23 and v0.24 each shipped a GitHub Release while npm sat at 0.20.0. Anyone running `npm i -g @oratis/lisa` — or installing via the Homebrew formula, which follows npm — got a build four versions old, with no signal that anything was stale. The fix is to stop relying on a human remembering. A new `npm-publish` job runs on the same tag push, gated `needs: build`, so the registry never receives a version whose tests failed or whose artifacts didn't assemble. The job is deliberately thin because the real gate already exists: package.json's `prepublishOnly` runs api-contract + typecheck + test + build, and `npm publish` invokes it on its own. Details worth knowing: - `if: github.event_name == 'push'` — workflow_dispatch exists to REBUILD artifacts for an already-shipped tag; re-publishing that to npm is never wanted, and npm would reject it anyway. - A pre-flight `npm view` check skips the publish when the version is already on the registry. Without it a re-run turns a green release red, since npm treats a duplicate version as a hard error. Verified both directions: 0.24.0 (published) → skip, 0.25.0 (absent) → publish. - `--provenance` attaches a signed, verifiable link from the tarball back to this workflow run and commit; it needs `id-token: write`, granted at job scope only. Requires a one-time `NPM_TOKEN` repo secret — an npm *automation* token, which bypasses 2FA (CI can't answer an interactive OTP prompt). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
npm publishing has been a manual local step from the start, and it kept being forgotten:
Four releases in a row. Anyone running
npm i -g @oratis/lisa— or installing via the Homebrew formula, which follows npm — got a build four versions old, with nothing signalling it was stale.What
A
npm-publishjob on the same tag push, gatedneeds: buildso the registry never receives a version whose tests failed or whose artifacts didn't assemble.The job is deliberately thin: the real gate already lives in
package.json'sprepublishOnly(check:api-contract && typecheck && test && build), whichnpm publishruns itself.Details worth reviewing
if: github.event_name == 'push'—workflow_dispatchexists to rebuild artifacts for an already-shipped tag. Re-publishing that is never wanted (and npm would reject it).npm viewskip. npm treats a duplicate version as a hard error, so without this a workflow re-run would turn a green release red. Verified both directions locally:--provenanceattaches a signed, verifiable link from the tarball back to this workflow run and commit. Needsid-token: write, granted at job scope only (the workflow-levelcontents: writeis untouched).NPM_TOKENis not configured on this repo yet — I checked. Until it is, the job will run and the publish step will fail.(Automation type bypasses 2FA — CI cannot answer an interactive OTP prompt.)
NPM_TOKENVerification
js-yamlparses clean; job graph isbuild → npm-publishwith the 6 steps as intended.🤖 Generated with Claude Code