ci(release): Guard publishable package config

.craft.yml

@@ -2,6 +2,14 @@ minVersion: 0.23.1
 changelogPolicy: none
 preReleaseCommand: bash scripts/craft-pre-release.sh
 targets:
+  - name: npm
+    id: "@vitest-evals/core"
+    access: public
+    includeNames: /^vitest-evals-core-\d.*\.tgz$/
+  - name: npm
+    id: "@vitest-evals/report-ui"
+    access: public
+    includeNames: /^vitest-evals-report-ui-\d.*\.tgz$/
   - name: npm
     id: "vitest-evals"
     includeNames: /^vitest-evals-\d.*\.tgz$/

.github/workflows/merge-jobs.yml

@@ -66,6 +66,8 @@ jobs:
       - name: Pack NPM Tarballs
         run: |
           mkdir -p artifacts
+          pnpm --filter @vitest-evals/core pack --pack-destination artifacts
+          pnpm --filter @vitest-evals/report-ui pack --pack-destination artifacts
           pnpm --filter vitest-evals pack --pack-destination artifacts
           pnpm --filter @vitest-evals/harness-ai-sdk pack --pack-destination artifacts
           pnpm --filter @vitest-evals/harness-openai-agents pack --pack-destination artifacts

README.md

@@ -153,6 +153,11 @@ then moves `vX.Y.Z` and the stable `vX` tag to the bundled action commit. The
 Craft GitHub target creates the release but is filtered away from package
 artifacts so it does not upload npm package contents as release assets.
 
+Release config validation treats every non-private `packages/*/package.json` as
+publishable. `pnpm release:check` verifies that `.craft.yml`, the post-merge
+pack step, Craft artifact selectors, package version bumping, and the bundled
+action tag workflow all cover that manifest-derived package set.
+
 ## Example
 
 The `apps/demo-pi` app shows the intended explicit-run flow:

scripts/bump-release-versions.mjs

@@ -1,26 +1,26 @@
 #!/usr/bin/env node
 import fs from "node:fs";
 import path from "node:path";
+import { collectPublishablePackages } from "./release-packages.mjs";
 
 const newVersion = process.argv[2];
 if (!newVersion) {
   console.error("Usage: node scripts/bump-release-versions.mjs <new-version>");
   process.exit(1);
 }
 
-const files = [
-  "packages/vitest-evals/package.json",
-  "packages/harness-ai-sdk/package.json",
-  "packages/harness-openai-agents/package.json",
-  "packages/harness-pi-ai/package.json",
-  "packages/github-reporter/package.json",
-];
+const packages = collectPublishablePackages();
 
-for (const relativePath of files) {
+if (packages.length === 0) {
+  console.error("No publishable packages found under packages/.");
+  process.exit(1);
+}
+
+for (const { relativePath } of packages) {
   const absolutePath = path.resolve(process.cwd(), relativePath);
   const pkg = JSON.parse(fs.readFileSync(absolutePath, "utf8"));
   pkg.version = newVersion;
   fs.writeFileSync(absolutePath, `${JSON.stringify(pkg, null, 2)}\n`);
 }
 
-console.log(`Updated ${files.length} package versions to ${newVersion}`);
+console.log(`Updated ${packages.length} package versions to ${newVersion}`);