chore(release): auto npm release workflow for all packages - #30
Merged
Conversation
Adds .github/workflows/release.yml that builds, tests, and publishes @conversed/core, @conversed/angular, and @conversed/react on push of a v* tag (or workflow_dispatch with dry_run for smoke tests). - Dist-tag derived from the version: prerelease -> rc, otherwise -> latest. - Npm provenance enabled per publish (id-token: write). - Version-guard step fails fast on mismatched package.json versions or stale @conversed/core cross-deps in react/angular. - Creates a GitHub Release on real tag pushes; marks prereleases. Also adds scripts/bump-version.sh to bump all four package.json files plus pinned cross-deps in one shot, and documents the release flow in CONTRIBUTING.md. scripts/release.sh stays as the manual emergency path. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Drop NODE_AUTH_TOKEN/NPM_TOKEN from publish steps; auth now flows through GitHub Actions OIDC via id-token: write. - Drop registry-url from setup-node (token-auth artifact). - Upgrade npm on the runner to >= 11.5.1 before publishing (Node 20 ships an older npm that predates Trusted Publishing support). - Update CONTRIBUTING.md release note. Each @conversed/* package is configured on npmjs.com to trust this repo's release.yml workflow, so no repo secret is required. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
…IBUTING New docs/releasing.md covers: the tag-triggered model, why merges do not publish, Trusted Publishing auth, the full step-by-step (bump → PR → tag), the dry-run smoke test, the manual emergency path, and the version scheme. CONTRIBUTING now just points at the guide instead of duplicating it. README docs index gains a "Releasing" entry. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/release.yml— a tag-triggered (v*) release workflow that builds, tests, and publishes@conversed/core,@conversed/angular, and@conversed/reactin one shot. Also supportsworkflow_dispatchwith adry_runinput for smoke tests.v*-rc.*→rc, otherwise →latest.NPM_TOKENsecret is needed. Each@conversed/*package is already configured on npmjs.com to trust this repo'srelease.yml.scripts/bump-version.sh— bumps root + all three package.json files and the pinned@conversed/corecross-deps in one command, so nothing drifts.scripts/release.shstays as the manual emergency path if CI is down.CONTRIBUTING.mdwith the new release flow.Release flow after this lands
CI does the rest.
Test plan
dry_run: true. Confirm all three packages runnpm publish --dry-runsuccessfully — this proves the OIDC trust setup end-to-end without publishing anything.v0.0.1-rc.14as the first live release from CI.