Skip to content

feat: add npm release workflow#45

Closed
zdburrage wants to merge 4 commits intomainfrom
feat/npm-release
Closed

feat: add npm release workflow#45
zdburrage wants to merge 4 commits intomainfrom
feat/npm-release

Conversation

@zdburrage
Copy link
Copy Markdown
Collaborator

@zdburrage zdburrage commented May 4, 2026

Summary

  • Add Trusted Publisher / OIDC-based npm publish workflow (publish-npm.yml) modeled on the authkit-tanstack-start pattern Nick Nisi set up org-wide
  • Document the release process in docs/releasing.md (one-time setup, public-repo readiness checklist, version-tag rule)
  • Wire up package metadata: bin, files, publishConfig, prepack/prepublishOnly/prepare scripts, npm pack --dry-run smoke check
  • Untrack dist/ (150 stale artifacts) and add to .gitignore — workflow rebuilds dist on publish via prepack
  • Add concurrency control to the publish workflow (matches workos/widgets) so simultaneous releases can't race

Why

WorkOS migrated all TS SDKs to npm Trusted Publishers in early 2026 after npm killed long-lived tokens. This brings workos-migrations onto that pattern so we can publish to npm and ship npx workos-migrations@latest per the plan in #proj-smoother-migrations.

What still needs to happen externally

These can't be done from a PR — needs npm org admin:

  • Reserve workos-migrations on npm
  • Add this repo as a Trusted Publisher (workflow filename: publish-npm.yml, environment: npm)
  • Add maintainers (SE Team)
  • Configure GitHub npm environment with required reviewers (manual approval gate)

Test plan

  • npm run build succeeds and regenerates dist/
  • npm run smoke:bin (CLI --help) renders correctly
  • npm run package:dry-run shows expected tarball contents (153 files, 98.1 kB)
  • npm run check passes (lint + format + typecheck + 229 tests + build)
  • Workflow dry-run: confirm via test release after Trusted Publisher is configured on npm
  • Verify tag-version match guard blocks mismatched tags

Notes for review

  • Single-package repo, npm-based — intentionally not adopting Changesets or pnpm. Those are right for workos/widgets (pnpm workspace, multiple packages, frequent releases) but overkill here.
  • Triggered on GitHub Release published — more locked-down than workflow_dispatch because the tag-vs-version check enforces correctness.

🤖 Generated with Claude Code

zdburrage and others added 2 commits May 4, 2026 09:36
…rrency

- Add dist/ to .gitignore and untrack the 150 stale build artifacts.
  The publish workflow rebuilds dist via prepack, and consumers receive
  a fresh build in the npm tarball — tracking dist only causes merge
  noise and divergence between source and committed artifacts.
- Add `prepare: npm run build` so installs from a git URL still build.
- Add concurrency control to publish-npm.yml to prevent racing publishes
  if two releases trigger simultaneously (matches workos/widgets pattern).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@zdburrage zdburrage marked this pull request as ready for review May 4, 2026 15:10
devin-ai-integration[bot]

This comment was marked as resolved.

zdburrage added 2 commits May 4, 2026 15:27
Reference `npm run check` as the single command to run before opening a
pull request, mention the additional CI smoke and package dry-run steps,
and bump the documented Node.js requirement to `>=22.11.0` to match
`engines` in package.json.
Resolve conflicts caused by untracking `dist/` on this branch while
`main` continued to update generated artifacts. dist/ is now ignored
and rebuilt by `prepack`/`prepare`, so all dist conflicts are
resolved by removing the files.
@zdburrage zdburrage closed this May 4, 2026
@zdburrage
Copy link
Copy Markdown
Collaborator Author

Holding off to put this logic into the main CLI

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant