Repository navigation
feat(release): publish the CLI to npm with semantic-release; CI and Dependabot - #5
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…finding - semantic-release 25.0.9 with commit-analyzer 13, release-notes-generator 14, @semantic-release/npm 13 and @semantic-release/github 12. - conventional-changelog-conventionalcommits pinned to ^9: v10 needs conventional-changelog-writer@9, but release-notes-generator 14.x ships writer 8 (the norbix-js and norbix-net releases failed on exactly this). - npm audit fix (brace-expansion, high). npm audit: 0. - Lockfile verified with npm@10 ci and npm@11 ci (CI's Node 22 bundles npm 10). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- Move the draft workflows from github-workflows/ into .github/workflows so they actually run. - ci.yml: Node 20/22/24 on Linux, macOS, Windows; typecheck, build and a --help smoke test everywhere, tests on Node 22+ (vitest 5 needs ^22.12 || >=24). Package job checks the tarball (oclif manifest present, no src/tests) and runs npm audit. - release.yml: semantic-release on push to main/next/beta instead of manual version tags. Publishes with npm trusted publishing (OIDC, npm 11 on the runner) and provenance; NPM_TOKEN only as a fallback. No commit back to the protected main. workflow_dispatch republish=true recovers a tag whose npm publish failed. - .releaserc.json: same release rules as norbix-js. - dependabot.yml: weekly npm + GitHub Actions updates with conventional commit prefixes; ignores the changelog preset >= 10. - ROADMAP.md: describe the automated release. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
new URL('..', import.meta.url).pathname yields '/D:/a/cli/cli/' on Windows,
so oclif's Config.load could not find package.json and 25 of 42 tests failed
on the Windows CI runners.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was referenced Sep 16, 2026
Domantas
added a commit
that referenced
this pull request
Sep 16, 2026
After #5 merged, docs PRs landed seconds later; the run for an earlier SHA logged "The local branch main is behind the remote one, therefore a new version won't be published". Fetch and reset to origin/<branch> first, as norbix-js's release job does. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
🎉 This PR is included in version 0.2.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sets up automated npm releases for
@norbix.ai/cli, using what we learned from norbix-js (sdk-ts #40–#43) and norbix-net (sdk-net #53).1.
norbix.dev→norbix.ai(from #4):package.jsonhomepage andRESEARCH.md. Nonorbix.devremains.2. Tooling (
package.json/ lockfile)conventional-changelog-conventionalcommitspinned to ^9: v10 breaks release notes with release-notes-generator 14.x ("Missing helper"), which failed both other repos' releases.npm audit fix(brace-expansion, high): 0 vulnerabilities. Lockfile verified withnpm@10 ciandnpm@11 ci.3. Windows test fix:
tests/_helpers.tsbuilt the CLI root fromURL.pathname, which yields/D:/a/...on Windows, so 25 of 42 tests failed there. It now usesfileURLToPath.4. Workflows: the drafts in
github-workflows/never ran, so they move to.github/workflows.ci.yml: Node 20/22/24 × Linux/macOS/Windows: typecheck, build,--helpsmoke test; tests on Node 22+ (vitest 5 needs ^22.12). A package job checks the tarball (oclif manifest included, no src/tests) and runsnpm audit.release.yml: semantic-release on push tomain(andnext/betaprereleases), replacing manualnpm versiontags.NPM_TOKENis only a fallback: npm now requires 2FA (OTP) for token-based publishes, which failed sdk-ts's release.main:package.jsonversionstays stale; tags and GitHub Releases are the source of truth.workflow_dispatchwithrepublish=truerecovers a tag whose npm publish failed..releaserc.json: same rules as norbix-js.dependabot.yml: weekly npm + Actions updates with conventional prefixes.Version baseline
There were no git tags, so semantic-release would have published 1.0.0. Tag
v0.1.0now markse069209, the earliest commit, which matches the published 0.1.0 (published a day before the git history starts). Commits since then aren't conventional, so this PR's squash title decides the release:feat(release): …→ 0.2.0, which ships everything added since 0.1.0 (files publish/unpublish, push commands, …). To not release yet, retitle itci: ….Before merging: npmjs.com (maintainer)
@norbix.ai/cli→ Settings → Trusted Publisher → GitHub Actions: organizationnorbix-code, repositorycli, workflowrelease.yml, environment empty.Test plan
--helpsmoke, package check,npm audit: all pass locallyanalyzeCommits+generateNotessincev0.1.0: no release as-is; with this PR's title → 0.2.0 notesv0.2.0, GitHub Release🤖 Generated with Claude Code