fix(ci): fix node/bun build step

.github/workflows/external-tests.yml

@@ -148,7 +148,7 @@ jobs:
 
       - name: Install node dependencies
         shell: bash
-        run: cd packages/fff-node && npm install
+        run: cd packages && npm ci
 
       - name: Run node tests
         shell: bash
@@ -198,12 +198,14 @@ jobs:
         run: cargo build --release -p fff-c
 
       - name: Install workspace npm deps
-        run: npm install --no-package-lock
+        working-directory: packages
+        run: npm ci
 
       # Upstream @yuuang/ffi-rs-linux-x64-musl ships with libc:"glibc" in
       # its package.json (a publishing bug in ffi-rs), so npm filters it
       # out. Force-install it so the FFI runtime is present on Alpine.
       - name: Install ffi-rs musl runtime
+        working-directory: packages
         run: |
           FFI_RS_VERSION=$(node -p "require('ffi-rs/package.json').version")
           npm install --no-package-lock --no-save --force \
@@ -214,7 +216,7 @@ jobs:
       # this is what exercises detectLinuxLibc().
       - name: Stage musl bin package
         run: |
-          PKG_DIR=node_modules/@ff-labs/fff-bin-linux-x64-musl
+          PKG_DIR=packages/node_modules/@ff-labs/fff-bin-linux-x64-musl
           mkdir -p "$PKG_DIR"
           cp target/release/libfff_c.so "$PKG_DIR/libfff_c.so"
           cat >"$PKG_DIR/package.json" <<'JSON'

.github/workflows/release.yaml

@@ -2,7 +2,7 @@ name: Build & Publish
 
 on:
   push:
-    branches: [main, fix/use-trusted-publishing]
+    branches: [main, fix/npm-pulish]
     tags:
       - "v*"
   pull_request:
@@ -509,7 +509,7 @@ jobs:
     name: Release
     needs: [build-nvim, build-c, build-mcp, build-python, build-python-sdist]
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/fix/use-trusted-publishing' || startsWith(github.ref, 'refs/tags/v'))
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
     permissions:
       contents: write
     steps:
@@ -669,7 +669,7 @@ jobs:
     name: Publish Python wheels to PyPI
     needs: [build-python, build-python-sdist]
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/fix/use-trusted-publishing' || startsWith(github.ref, 'refs/tags/v'))
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
     environment:
       name: pypi
       url: https://pypi.org/p/fff-search
@@ -694,7 +694,7 @@ jobs:
     name: Publish Rust crates
     needs: [build-nvim, build-c, build-mcp]
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/fix/use-trusted-publishing' || startsWith(github.ref, 'refs/tags/v'))
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
     permissions:
       contents: read
       id-token: write
@@ -725,7 +725,7 @@ jobs:
     name: Publish npm packages
     needs: [build-c]
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/fix/use-trusted-publishing' || startsWith(github.ref, 'refs/tags/v'))
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/fix/npm-pulish' || startsWith(github.ref, 'refs/tags/v'))
     permissions:
       contents: read
       id-token: write
@@ -771,6 +771,16 @@ jobs:
             fi
           done
 
+      # Every install must happen before the first set-npm-version: the bump
+      # injects platform optionalDependencies that only resolve once published,
+      # and npm ci validates the whole workspace against the lockfile.
+      - name: Install and build JS packages
+        working-directory: packages
+        run: |
+          npm ci
+          (cd fff-bun && npm run build)
+          (cd fff-node && npm run build)
+
       - name: Publish bun package
         run: |
           VERSION="${{ steps.version.outputs.version }}"
@@ -780,8 +790,6 @@ jobs:
           make set-npm-version PKG=packages/fff-bun VERSION="$VERSION"
 
           cd packages/fff-bun
-          bun install --frozen-lockfile
-          bun run build
           npm publish --tag "$TAG" --access public --provenance
 
       - name: Publish Node.js package
@@ -793,8 +801,6 @@ jobs:
           make set-npm-version PKG=packages/fff-node VERSION="$VERSION"
 
           cd packages/fff-node
-          npm install
-          npm run build
           npm publish --tag "$TAG" --access public --provenance
 
       - name: Publish pi-fff package

Makefile

@@ -274,28 +274,15 @@ test-stress: test-stress-seeded test-stress-random test-stress-regressions test-
 set-npm-version:
 	@test -n "$(PKG)" || (echo "PKG is required" && exit 1)
 	@test -n "$(VERSION)" || (echo "VERSION is required" && exit 1)
-	node -e " \
-		const fs = require('fs'); \
-		const pkg = JSON.parse(fs.readFileSync('$(PKG)/package.json', 'utf8')); \
-		pkg.version = '$(VERSION)'; \
-		if (pkg.optionalDependencies) { \
-			for (const dep of Object.keys(pkg.optionalDependencies)) { \
-				pkg.optionalDependencies[dep] = '$(VERSION)'; \
-			} \
-		} \
-		for (const dep of ['@ff-labs/fff-bun', '@ff-labs/fff-node']) { \
-			if (pkg.dependencies?.[dep]) pkg.dependencies[dep] = '$(VERSION)'; \
-		} \
-		fs.writeFileSync('$(PKG)/package.json', JSON.stringify(pkg, null, 2) + '\n'); \
-	"
+	node scripts/set-npm-version.mjs "$(PKG)" "$(VERSION)"
 	@echo "Set $(PKG) to $(VERSION)"
 
 format-rust:
 	cargo fmt --all
 format-lua:
 	stylua .
 format-ts:
-	bun format
+	cd packages && bun format
 
 format: format-rust format-lua format-ts
 
@@ -304,7 +291,7 @@ lint-rust:
 lint-lua:
 	 ~/.luarocks/bin/luacheck .
 lint-ts:
-	bun lint
+	cd packages && bun lint
 
 lint: lint-rust lint-lua lint-ts