Skip to content

chore(release): adopt Changesets for automated publishing - #28

Merged
lbb00 merged 3 commits into
mainfrom
chore/adopt-changesets
Sep 14, 2026
Merged

lbb00 merged 3 commits into
mainfrom
chore/adopt-changesets

Conversation

@lbb00

@lbb00 lbb00 commented Sep 14, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Replace the GitHub-Release-triggered publish.yml with release.yml, driven by Changesets: contributors add changeset files, a bot PR aggregates them, merging it runs changeset version + changeset publish automatically.
  • Keep @devicekit/devices and @devicekit/frame version-locked via a fixed group, matching current practice.
  • Switch npm publishing to pure OIDC trusted publishing (id-token: write + environment: npm-release), dropping the stored NPM_TOKEN.
  • Update CONTRIBUTING.md and CHANGELOG.md to describe the new flow.

Test plan

  • node --test scripts/release-guard.test.mjs passes
  • pnpm test passes
  • Merge to main (no-op: current npm versions already match package.json, so changeset publish will find nothing to do)
  • Real end-to-end verification via a changesets prerelease (alpha tag) publish, to confirm OIDC trusted publishing actually works — planned as a follow-up after this merges

🤖 Generated with Claude Code

lbb00 and others added 3 commits September 14, 2026 16:20
Replace the manual GitHub-Release-triggers-publish flow with Changesets:
merging a version PR to main now drives the release instead of a human
cutting a Release and picking a dist-tag by hand. @devicekit/devices and
@devicekit/frame stay fixed together since they've always shipped as one
version. Retires npm-dist-tag.mjs and its test (dist-tag resolution is now
changesets' job) and the merge-base guard in publish.yml (push-to-main
triggers can't point at an arbitrary branch the way a Release could), while
keeping the main-branch restriction under a renamed release-guard.test.mjs.
The prior commit renamed publish-guard.test.mjs to release-guard.test.mjs
but the git mv happened before the content rewrite got staged, so it was
committed with its old publish.yml-parsing content under the new filename.
Gate the release job behind the npm-release GitHub environment and
drop the NPM_TOKEN/provenance env vars now that both packages have
npm trusted publisher entries configured for release.yml.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@lbb00
lbb00 merged commit 0180213 into main Sep 14, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant