Skip to content

feat(ci): rewrite CI for npm publish #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NoNamer777 wants to merge 3 commits into
base: main
Choose a base branch
from
Open

feat(ci): rewrite CI for npm publish #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
150aa00
chore(ci): drop the release job's unused major/major-minor outputs
NoNamer777 Aug 14, 2026
eeb2d16
feat(ci): publish releases to npm's stage queue via trusted publishing
NoNamer777 Aug 14, 2026
672f9ab
fix(ci): bump the library's own package.json version during release p…
NoNamer777 Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 8 additions & 5 deletions .github/workflows/release-prepare.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,14 +80,17 @@ jobs:
level=$(node scripts/changelog/index.ts bump-level --override "$BUMP_LEVEL")
echo "level=$level" >> "$GITHUB_OUTPUT"

- name: Bump package.json version
# Bumps the library project's own package.json, not the workspace root's: ng-packagr
# publishes projects/template-lib-angular/package.json's version, and the two have been
# independent since the library was scaffolded (root stayed at 0.0.0).
- name: Bump library package.json version
id: version
shell: bash
env:
LEVEL: ${{ steps.bump-level.outputs.level }}
run: |
pnpm version "$LEVEL" --no-git-tag-version
version=$(node -p "require('./package.json').version")
pnpm --dir projects/template-lib-angular version "$LEVEL" --no-git-tag-version
version=$(node -p "require('./projects/template-lib-angular/package.json').version")
echo "version=$version" >> "$GITHUB_OUTPUT"

- name: Update CHANGELOG.md
Expand All @@ -111,7 +114,7 @@ jobs:
--arg repo "$REPO" \
--arg headOid "$head_oid" \
--arg message "chore(release): $VERSION" \
--rawfile packageJson package.json \
--rawfile libraryPackageJson projects/template-lib-angular/package.json \
--rawfile changelog CHANGELOG.md \
'{
query: "mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid } } }",
Expand All @@ -122,7 +125,7 @@ jobs:
expectedHeadOid: $headOid,
fileChanges: {
additions: [
{ path: "package.json", contents: ($packageJson | @base64) },
{ path: "projects/template-lib-angular/package.json", contents: ($libraryPackageJson | @base64) },
{ path: "CHANGELOG.md", contents: ($changelog | @base64) }
]
}
Expand Down
48 changes: 41 additions & 7 deletions .github/workflows/release-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,6 @@ jobs:
contents: read
outputs:
version: ${{ steps.version.outputs.version }}
major: ${{ steps.version.outputs.major }}
major-minor: ${{ steps.version.outputs.major-minor }}
steps:
- name: Checkout repo
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Expand All @@ -35,13 +33,8 @@ jobs:
REF_NAME: ${{ github.ref_name }}
run: |
version="${REF_NAME#v}"
major="${version%%.*}"
rest="${version#*.}"
minor="${rest%%.*}"

echo "version=$version" >> "$GITHUB_OUTPUT"
echo "major=$major" >> "$GITHUB_OUTPUT"
echo "major-minor=$major.$minor" >> "$GITHUB_OUTPUT"

- name: Extract release notes
shell: bash
Expand All @@ -65,3 +58,44 @@ jobs:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
VERSION: ${{ steps.version.outputs.version }}
run: gh release create "v$VERSION" --notes-file release-notes.md --discussion-category announcements

publish:
name: Publish to npm
runs-on: ubuntu-22.04
timeout-minutes: 5
permissions:
id-token: write
contents: read
steps:
- name: Checkout repo
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Setup Pnpm
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

- name: Setup Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

@NoNamer777 NoNamer777 Aug 14, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Spec] The research doc (docs/research/npm-trusted-publishing.md) requires npm CLI >= 11.15.0 for staged publishing. Nothing here checks or pins the npm CLI version; it relies on whatever version ships with the resolved Node version. If a runner resolves an older bundled npm, npm stage publish fails with no signal tied to this requirement. Consider adding an explicit version check or npm install -g npm@latest before the publish step.

with:
node-version-file: 'package.json'
registry-url: 'https://registry.npmjs.org'
scope: '@dnd-mapp'

@NoNamer777 NoNamer777 Aug 14, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Spec, minor] The research doc calls out package-manager-cache: false explicitly for the release job's setup-node step. This step just omits cache:, which is functionally equivalent but doesn't match the documented explicit flag. Low severity; consider adding it for consistency with the doc.


- name: Install dependencies
shell: bash
run: pnpm i
Comment on lines +75 to +87

@NoNamer777 NoNamer777 Aug 14, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Standards] This duplicates prepare-workspace's Setup Pnpm / Setup Node.js / Install dependencies steps instead of reusing the composite action, and it silently drops the cache: 'pnpm' step that action sets. Consider adding an optional registry-url input to .github/actions/prepare-workspace/action.yml and calling it here instead, the way the release job already does.


- name: Build library
shell: bash
run: pnpm build

# Trusted Publishing exchanges the job's OIDC token (`id-token: write` above) for a
# short-lived publish credential; no NPM_TOKEN secret is involved. `npm stage publish`
# (rather than `npm publish`) uploads to the stage queue and doesn't require 2FA, so it
# completes from an unattended CI job; a maintainer separately approves it with 2FA
# (CLI or npmjs.com) before it becomes the installable version.
- name: Publish to npm stage queue
shell: bash
working-directory: dist/template-lib-angular
run: npm stage publish