Cut releases from the changelog and publish with OIDC - #64
Merged
Conversation
A push to main now ends with release-detect, which compares the latest dated release in CHANGELOG.md against what is on npm and dispatches release.yml when the changelog is ahead. npm rather than the git tags, because npm is what a publish collides with, and this repository has no tags at all. The release job authenticates with npm trusted publishing instead of a long-lived token, so it runs in a release environment with id-token write. That is the one step that is not bun: bun publish cannot use the workflow's OIDC token yet (oven-sh/bun#22423), so npm uploads a tarball bun pm pack produced. Packing with bun is also what resolves the catalog: ranges npm would otherwise publish verbatim. The published version is taken from the changelog at release time rather than committed, which is what the old changelog-updater tried to do. It could not have worked: it handed the changelog CLI an absolute path that the CLI joins onto its own working directory, so prepublishOnly died on ENOENT. prepublishOnly is now a prepack, which is what bun pm pack runs. The package also gained the repository field provenance requires, and the release script copies the root README and LICENSE next to the manifest, because only the ones sitting there get published. Moving the plugin into packages/ had silently dropped both from the tarball.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A push to main now ends with release-detect, which compares the latest dated release in CHANGELOG.md against what is on npm and dispatches release.yml when the changelog is ahead. npm rather than the git tags, because npm is what a publish collides with, and this repository has no tags at all.
The release job authenticates with npm trusted publishing instead of a long-lived token, so it runs in a release environment with id-token write. That is the one step that is not bun: bun publish cannot use the workflow's OIDC token yet (oven-sh/bun#22423), so npm uploads a tarball bun pm pack produced. Packing with bun is also what resolves the catalog: ranges npm would otherwise publish verbatim.
The published version is taken from the changelog at release time rather than committed, which is what the old changelog-updater tried to do. It could not have worked: it handed the changelog CLI an absolute path that the CLI joins onto its own working directory, so prepublishOnly died on ENOENT. prepublishOnly is now a prepack, which is what bun pm pack runs.
The package also gained the repository field provenance requires, and the release script copies the root README and LICENSE next to the manifest, because only the ones sitting there get published. Moving the plugin into packages/ had silently dropped both from the tarball.