Release workflow: version dropdown + publish to public npm with provenance - #24
Merged
jonathanKingston merged 3 commits intoJul 5, 2026
Merged
Conversation
Replace the free-text `version` input with a `bump` choice dropdown (patch/minor/major/prepatch/preminor/premajor/prerelease) plus an optional `exact_version` text field that overrides the dropdown when set. The resolve step prefers the exact version when provided, otherwise applies the bump. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GybqjwKSadmFZv4cxE5Y5N
@copse is the org's npm scope, and the README already documents `npm install @copse/streaming-markdown` (a public-npm install). GitHub Packages would force an @copse-dev rename and require consumers to auth even to install, so target public npm instead: - setup-node registry-url -> registry.npmjs.org - publish authenticates with the NPM_TOKEN secret (not GITHUB_TOKEN) - publishConfig pins the public registry + access:public for the scoped package - drop the now-unneeded `packages: write` permission Requires an NPM_TOKEN repo secret with publish rights on the @copse scope. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GybqjwKSadmFZv4cxE5Y5N
Add id-token: write and `npm publish --provenance` so releases carry a signed provenance attestation (via GitHub OIDC) linking the package to its source commit and build, surfaced as a verified badge on npm. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GybqjwKSadmFZv4cxE5Y5N
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #20, refining the release workflow.
Changes
Version input is now a dropdown. The free-text
versionfield is replaced by abumpchoiceinput (patch/minor/major/prepatch/preminor/premajor/prerelease) plus an optionalexact_versiontext field that overrides the dropdown when set. GitHub Actionschoiceinputs can only offer a fixed list, so the override preserves the ability to pin an exact version.Publish target switched from GitHub Packages to public npm.
@copseis the org's npm scope and the README already documentsnpm install @copse/streaming-markdown. GitHub Packages would have forced an@copse-devrename and required consumers to authenticate even to install. So:setup-noderegistry-url→registry.npmjs.orgNPM_TOKENsecret (notGITHUB_TOKEN)publishConfigpins the public registry +access: publicfor the scoped packagepackages: writepermissionnpm provenance. Added
id-token: writeandnpm publish --provenanceso releases carry a signed attestation (via GitHub OIDC) linking the package to its source commit and build, shown as a verified badge on npm.Prerequisite
Requires an
NPM_TOKENrepo secret — a granular access token scoped to the@copsescope with publish rights (scope-level so it can create the package on first publish). Added.Validation
Ran the full pre-publish pipeline locally against a clean install: CI gate green (428/428 tests, typecheck, build), version resolve (
patch→v0.1.2), changelog correctly scoped to commits sincev0.1.1, andnpm publish --dry-runtarball ships onlydist/+README.md+LICENSE. The live publish + provenance run only inside Actions (needs the OIDC token).🤖 Generated with Claude Code
Generated by Claude Code