feat(ci): rewrite CI for npm publish - #11
Conversation
Removing the app-runtime Docker scaffolding already dropped the promote-image job that consumed these to tag major/major-minor floating Docker image tags; nothing reads them anymore.
Adds a publish job to release-publish.yml that builds the library and runs npm stage publish, authenticated via GitHub Actions OIDC (id-token: write) instead of a stored NPM_TOKEN. Staging rather than publishing directly means a maintainer still has to approve the version with 2FA before it goes live; CI itself never has the power to make a version public on its own. Trusted Publishing and staged publishing both require the package to already exist on the registry, so this only takes effect once the one-time manual bootstrap publish and the npm Trusted Publisher link (#6) are done; until then this job will fail, which is expected per the map's decision to leave the pipeline wired-but-unexercised for now.
…repare release-prepare.yml bumped the workspace root's package.json, but ng-packagr publishes projects/template-lib-angular/package.json's version — the two have been independent since the library was scaffolded (root stuck at 0.0.0, library at 0.0.1). Left unfixed, every release would tag and changelog one version while npm published a different, never-bumped one. Repoints the bump step and the verified-commit-on-main mutation at the library's package.json instead.
NoNamer777
left a comment
NoNamer777
left a comment
There was a problem hiding this comment.
Reviewed against issue #5 and the repo's CI/changelog conventions (Standards + Spec axes). Three inline notes below, plus two general ones for files outside this diff: no CHANGELOG.md entry for these CI changes, and no repository field in the library's package.json.
| - name: Setup Pnpm | ||
| uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | ||
| with: | ||
| node-version-file: 'package.json' | ||
| registry-url: 'https://registry.npmjs.org' | ||
| scope: '@dnd-mapp' | ||
|
|
||
| - name: Install dependencies | ||
| shell: bash | ||
| run: pnpm i |
There was a problem hiding this comment.
[Standards] This duplicates prepare-workspace's Setup Pnpm / Setup Node.js / Install dependencies steps instead of reusing the composite action, and it silently drops the cache: 'pnpm' step that action sets. Consider adding an optional registry-url input to .github/actions/prepare-workspace/action.yml and calling it here instead, the way the release job already does.
| uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 |
There was a problem hiding this comment.
[Spec] The research doc (docs/research/npm-trusted-publishing.md) requires npm CLI >= 11.15.0 for staged publishing. Nothing here checks or pins the npm CLI version; it relies on whatever version ships with the resolved Node version. If a runner resolves an older bundled npm, npm stage publish fails with no signal tied to this requirement. Consider adding an explicit version check or npm install -g npm@latest before the publish step.
| with: | ||
| node-version-file: 'package.json' | ||
| registry-url: 'https://registry.npmjs.org' | ||
| scope: '@dnd-mapp' |
There was a problem hiding this comment.
[Spec, minor] The research doc calls out package-manager-cache: false explicitly for the release job's setup-node step. This step just omits cache:, which is functionally equivalent but doesn't match the documented explicit flag. Low severity; consider adding it for consistency with the doc.
|
[Standards] This repo's Changelog Conventions treat "changed CI or build setup that's copied into the new repo" as consumer-facing for a template repo. |
|
[Spec] |
1 participant
Summary
Rewrites
release-publish.yml/release-prepare.ymlto publish@dnd-mapp/template-lib-angularto npm instead of building/publishing Docker images, per the research findings in Research npm Trusted Publishing + staged publishing (#4):publishjob torelease-publish.ymlthat builds the library and runsnpm stage publish, authenticated via GitHub Actions OIDC (id-token: write) instead of a storedNPM_TOKEN. Staging rather than publishing directly means a maintainer still approves the version with 2FA before it goes live, so CI never has the power to make a version public on its own. This job will fail until the one-time manual bootstrap publish and the npm Trusted Publisher link (#6) are done, which is expected per the map's decision to leave the pipeline wired-but-unexercised for now.releasejob'smajor/major-minoroutputs, dead since the Docker image-tagging job that consumed them was already removed in #3.release-prepare.yml's version-bump step, which bumped the workspace root'spackage.jsoneven though ng-packagr actually publishesprojects/template-lib-angular/package.json's version. The two have been independent since scaffolding (root stuck at0.0.0, library at0.0.1). Left unfixed, every release would tag/changelog one version while npm published a different, never-bumped one.sign-and-push-tagis not Docker-specific (it's the SSH tag-signing step used byrelease-prepare.yml/release-retry-tag.yml) and left it untouched.ci/action.ymlandprepare-workspace/action.ymlalready reflect the library's build/lint/test/typecheck pipeline from #3; no changes needed there.Related issues
Resolves #5
Checklist