Add tag-triggered npm release workflow - #4
Merged
Merged
Conversation
Publishes to npm via trusted publishing (OIDC) on a v*.*.* tag push, after running the same check gate as CI and a real pack/install smoke test of the tarball. Requires the trusted publisher to be configured on npmjs.com for tambo-labs/charming-cli + this workflow file before the first run — npm trusted-publisher config lives on the package's own settings page and can't be set up from the CLI. First real publish (usecharming@0.1.0) went out manually with 2FA, since OIDC trusted publishing can't perform the first publish of a package name that doesn't exist yet. Every release after that can use this workflow.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds `release.yml`: pushing a `v*..` tag runs the same `bun run check` gate as CI, verifies the tag matches `package.json`'s version, smoke-tests the real packed tarball (install + run `--version`/`--help`), then publishes to npm via trusted publishing (OIDC) and cuts a GitHub Release.
Follows the same GitHub App / action-pinning conventions as `sync-openapi.yml`.
Before this can run for real
npm trusted publishing has to be configured on npmjs.com for this repo:
The first publish (`usecharming@0.1.0`) already went out manually with 2FA — OIDC trusted publishing can't perform the first publish of a name that doesn't exist yet on the registry. Every release after that can go through this workflow.
Test plan