Skip to content

RELEASING.md

Latest commit

 

History

History
56 lines (45 loc) · 2.02 KB

RELEASING.md

File metadata and controls

56 lines (45 loc) · 2.02 KB

Releasing

This project uses Conventional Commits and a tag-driven GitHub Actions release workflow. npm publishing uses trusted publishing with GitHub Actions OIDC, so releases do not need a long-lived NPM_TOKEN secret.

One-time setup

  1. Confirm the package and trusted publisher are configured:
    • npm view @alecrust/workbox
    • npm trust list @alecrust/workbox
  2. The trusted publisher should point at this repository and workflow:
    • npm trust github @alecrust/workbox --repo AlecRust/workbox --file release.yml
  3. In npm package settings:
    • Require two-factor authentication for publishing/settings.
    • Disallow token publishing.
  4. Do not add or rely on a GitHub Actions NPM_TOKEN secret for publishing.

Release steps

  1. Make sure your working tree is clean and you are on main:
    • git status
    • git switch main && git pull --ff-only
  2. Run checks locally:
    • bun install
    • bun run check
    • bun test
    • npm pack --dry-run --ignore-scripts --json
  3. Bump the version in package.json (for example, 0.4.2).
  4. Update CHANGELOG.md with the release date and user-facing changes.
  5. Commit the release prep:
    • git add package.json CHANGELOG.md bun.lock
    • git commit -m "chore(release): prepare for v0.4.2"
  6. Create the tag:
    • git tag -a v0.4.2 -m "v0.4.2"
  7. Push commit and tag:
    • git push origin main
    • git push origin v0.4.2

What happens in CI

On tag push (v*.*.*), .github/workflows/release.yml:

  • Runs bun run check and bun test
  • Verifies package.json version matches the tag
  • Publishes @alecrust/workbox to npm with trusted publishing
  • Creates npm provenance through GitHub Actions OIDC
  • Creates a GitHub Release with notes generated by git-cliff

Verify a release

After the release workflow succeeds:

  • npm view @alecrust/workbox version
  • tmpdir=$(mktemp -d) && cd "$tmpdir" && bun add -g @alecrust/workbox && wkb --version
  • tmpdir=$(mktemp -d) && cd "$tmpdir" && npm init -y && npm install @alecrust/workbox && npm audit signatures