ci: add release workflow with npm trusted publishing - #9
Draft
valeriocomo wants to merge 1 commit into
Draft
valeriocomo wants to merge 1 commit into
valeriocomo wants to merge 1 commit into
Conversation
Ports jsverse/transloco's release.yml to this repo, as requested in openng-org#2. Manually dispatched, dry-run by default, with a test/build gate and all fallible git work ordered before the irreversible npm publish. The Nx steps are replaced with this repo's tooling: standard-version for the version bump and changelog, `gh release create` for the GitHub release, and `npm publish dist/openng/cashew`. Publishing uses OIDC trusted publishing, so no NPM_TOKEN is stored and provenance is attached automatically. Also adds the semantic-release variant as an inert, dispatch-only alternative so the two approaches can be compared on real files, and fixes the library manifest URLs, which pointed at the non-existent openng-foundation org. See docs/RELEASING.md for the runbook and the one-time admin setup (GitHub App bypass actor, npm trusted publisher, missing v5.x tags). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Ports jsverse/transloco's release.yml to this repo, as requested in #2. Manually dispatched, dry-run by default, with a test/build gate and all fallible git work ordered before the irreversible npm publish.
The Nx steps are replaced with this repo's tooling: standard-version for the version bump and changelog,
gh release createfor the GitHub release, andnpm publish dist/openng/cashew. Publishing uses OIDC trusted publishing, so no NPM_TOKEN is stored and provenance is attached automatically.Also adds the semantic-release variant as an inert, dispatch-only alternative so the two approaches can be compared on real files, and fixes the library manifest URLs, which pointed at the non-existent openng-foundation org.
See docs/RELEASING.md for the runbook and the one-time admin setup (GitHub App bypass actor, npm trusted publisher, missing v5.x tags).
Related issues
Ref to #2
Fixes #
Type of change
Breaking changes
None
Test plan
npm run buildnpm testnpm run lintChecklist
Additional context
It's all repoted in docs/RELEASING.md