From 150aa0067af0ec5067c27fa75ad486ec7672a9bf Mon Sep 17 00:00:00 2001 From: Oscar Wellner Date: Fri, 14 Aug 2026 09:30:22 +0200 Subject: [PATCH 1/3] chore(ci): drop the release job's unused major/major-minor outputs Removing the app-runtime Docker scaffolding already dropped the promote-image job that consumed these to tag major/major-minor floating Docker image tags; nothing reads them anymore. --- .github/workflows/release-publish.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index ee50092..adde369 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -17,8 +17,6 @@ jobs: contents: read outputs: version: ${{ steps.version.outputs.version }} - major: ${{ steps.version.outputs.major }} - major-minor: ${{ steps.version.outputs.major-minor }} steps: - name: Checkout repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -35,13 +33,8 @@ jobs: REF_NAME: ${{ github.ref_name }} run: | version="${REF_NAME#v}" - major="${version%%.*}" - rest="${version#*.}" - minor="${rest%%.*}" echo "version=$version" >> "$GITHUB_OUTPUT" - echo "major=$major" >> "$GITHUB_OUTPUT" - echo "major-minor=$major.$minor" >> "$GITHUB_OUTPUT" - name: Extract release notes shell: bash From eeb2d1683c7756731a4e61629d6c8632aa4bd78b Mon Sep 17 00:00:00 2001 From: Oscar Wellner Date: Fri, 14 Aug 2026 09:30:43 +0200 Subject: [PATCH 2/3] feat(ci): publish releases to npm's stage queue via trusted publishing Adds a publish job to release-publish.yml that builds the library and runs npm stage publish, authenticated via GitHub Actions OIDC (id-token: write) instead of a stored NPM_TOKEN. Staging rather than publishing directly means a maintainer still has to approve the version with 2FA before it goes live; CI itself never has the power to make a version public on its own. Trusted Publishing and staged publishing both require the package to already exist on the registry, so this only takes effect once the one-time manual bootstrap publish and the npm Trusted Publisher link (dnd-mapp/template-lib-angular#6) are done; until then this job will fail, which is expected per the map's decision to leave the pipeline wired-but-unexercised for now. --- .github/workflows/release-publish.yml | 41 +++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index adde369..aa39484 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -58,3 +58,44 @@ jobs: GH_TOKEN: ${{ steps.app-token.outputs.token }} VERSION: ${{ steps.version.outputs.version }} run: gh release create "v$VERSION" --notes-file release-notes.md --discussion-category announcements + + publish: + name: Publish to npm + runs-on: ubuntu-22.04 + timeout-minutes: 5 + permissions: + id-token: write + contents: read + steps: + - name: Checkout repo + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Setup Pnpm + uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 + + - name: Setup Node.js + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version-file: 'package.json' + registry-url: 'https://registry.npmjs.org' + scope: '@dnd-mapp' + + - name: Install dependencies + shell: bash + run: pnpm i + + - name: Build library + shell: bash + run: pnpm build + + # Trusted Publishing exchanges the job's OIDC token (`id-token: write` above) for a + # short-lived publish credential; no NPM_TOKEN secret is involved. `npm stage publish` + # (rather than `npm publish`) uploads to the stage queue and doesn't require 2FA, so it + # completes from an unattended CI job; a maintainer separately approves it with 2FA + # (CLI or npmjs.com) before it becomes the installable version. + - name: Publish to npm stage queue + shell: bash + working-directory: dist/template-lib-angular + run: npm stage publish From 672f9abfeef162e2a9dc640010945f3ddc2a4b9c Mon Sep 17 00:00:00 2001 From: Oscar Wellner Date: Fri, 14 Aug 2026 09:31:04 +0200 Subject: [PATCH 3/3] fix(ci): bump the library's own package.json version during release prepare MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit release-prepare.yml bumped the workspace root's package.json, but ng-packagr publishes projects/template-lib-angular/package.json's version — the two have been independent since the library was scaffolded (root stuck at 0.0.0, library at 0.0.1). Left unfixed, every release would tag and changelog one version while npm published a different, never-bumped one. Repoints the bump step and the verified-commit-on-main mutation at the library's package.json instead. --- .github/workflows/release-prepare.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml index 61b0d67..44e5c3b 100644 --- a/.github/workflows/release-prepare.yml +++ b/.github/workflows/release-prepare.yml @@ -80,14 +80,17 @@ jobs: level=$(node scripts/changelog/index.ts bump-level --override "$BUMP_LEVEL") echo "level=$level" >> "$GITHUB_OUTPUT" - - name: Bump package.json version + # Bumps the library project's own package.json, not the workspace root's: ng-packagr + # publishes projects/template-lib-angular/package.json's version, and the two have been + # independent since the library was scaffolded (root stayed at 0.0.0). + - name: Bump library package.json version id: version shell: bash env: LEVEL: ${{ steps.bump-level.outputs.level }} run: | - pnpm version "$LEVEL" --no-git-tag-version - version=$(node -p "require('./package.json').version") + pnpm --dir projects/template-lib-angular version "$LEVEL" --no-git-tag-version + version=$(node -p "require('./projects/template-lib-angular/package.json').version") echo "version=$version" >> "$GITHUB_OUTPUT" - name: Update CHANGELOG.md @@ -111,7 +114,7 @@ jobs: --arg repo "$REPO" \ --arg headOid "$head_oid" \ --arg message "chore(release): $VERSION" \ - --rawfile packageJson package.json \ + --rawfile libraryPackageJson projects/template-lib-angular/package.json \ --rawfile changelog CHANGELOG.md \ '{ query: "mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid } } }", @@ -122,7 +125,7 @@ jobs: expectedHeadOid: $headOid, fileChanges: { additions: [ - { path: "package.json", contents: ($packageJson | @base64) }, + { path: "projects/template-lib-angular/package.json", contents: ($libraryPackageJson | @base64) }, { path: "CHANGELOG.md", contents: ($changelog | @base64) } ] }