Skip to content

ci: add release.yml for npm publish on v* tags; fix author field #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yakimoto merged 1 commit into from
Sep 3, 2026
Merged

ci: add release.yml for npm publish on v* tags; fix author field #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 102 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,102 @@
# release.yml — publish @wave-av/cli to public npm on a `v*` tag.
#
# Fixes the 2026-09-03 P1: 1.0.8 shipped with an unpinned SDK dependency range that later
# resolved to a broken SDK release (crashed every fresh install with "module is not defined
# in ES module scope"). Until this file, publishing was a manual `npm publish` run from a
# laptop with no build/test/smoke gate in front of it. This workflow is the missing release
# path: every future version now ships through CI with a build + test + tarball smoke test
# before anything reaches npmjs.
#
# Publish: push a tag `v<semver>` matching package.json "version" (e.g. `v1.0.9`). The job
# fails closed if the tag and package.json disagree, so a stale tag can never publish the
# wrong version.
#
# Auth: npm trusted publishing (OIDC via `id-token: write`) is used automatically once this
# package is registered as a trusted publisher on npmjs for wave-av/cli + this workflow file.
# Until that registration exists, the `NPM_TOKEN` repository secret is used as a classic
# auth-token fallback (set only if present — an empty/missing secret does not touch .npmrc).
# Either path works with zero further changes to this file.

name: release

on:
push:
tags:
- "v*"

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: false

permissions:
contents: read

jobs:
release:
name: build, test, smoke, publish
runs-on: ubuntu-latest
timeout-minutes: 15
permissions:
contents: read
id-token: write # npm trusted publishing (OIDC) — unused when the NPM_TOKEN fallback applies
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
persist-credentials: false

- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: "22"

- name: Verify tag matches package.json version
run: |
PKG_VERSION="$(node -p "require('./package.json').version")"
TAG_VERSION="${GITHUB_REF_NAME#v}"
if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
echo "::error::tag $GITHUB_REF_NAME ($TAG_VERSION) != package.json version ($PKG_VERSION)"
exit 1
fi

- name: Install
run: npm ci --include=dev

- name: Build
run: npm run build

- name: Test
run: npm test

- name: Pack
run: npm pack

- name: Smoke test the packed tarball
# Installs the ACTUAL tarball npm publish would upload (not the source tree) into a
# throwaway project on the default public registry, then runs the built CLI exactly the
# way a fresh `npx @wave-av/cli` user would — this is the check 1.0.8 shipped without.
run: |
TARBALL="$(ls ./wave-av-cli-*.tgz)"
SMOKE_DIR="$(mktemp -d)"
cd "$SMOKE_DIR"
npm init -y >/dev/null
npm i "$GITHUB_WORKSPACE/$TARBALL"
VERSION="$(npx wave --version)"
EXPECTED="$(node -p "require('$GITHUB_WORKSPACE/package.json').version")"
echo "smoke: wave --version -> $VERSION (expected $EXPECTED)"
if [ "$VERSION" != "$EXPECTED" ]; then
echo "::error::tarball smoke test failed: got '$VERSION', expected '$EXPECTED'"
exit 1
fi

- name: Configure npm auth (NPM_TOKEN fallback only — OIDC trusted publishing needs no config here)
env:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
if [ -n "$NPM_TOKEN" ]; then
echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> ~/.npmrc
echo "npm auth: using NPM_TOKEN secret fallback"
else
echo "npm auth: no NPM_TOKEN secret set — relying on OIDC trusted publishing"
fi
Comment on lines +90 to +99

@gitar-bot gitar-bot Bot Sep 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Quality: NPM_TOKEN fallback step is dead weight once OIDC works, but harmless if left misconfigured

The 'Configure npm auth' step (.github/workflows/release.yml:90-99) only writes the token when NPM_TOKEN is non-empty, which correctly avoids the known npm CLI issue where a stray/invalid _authToken line in .npmrc blocks OIDC trusted publishing from being attempted at all. This is safe as written, but worth a one-line comment noting that the NPM_TOKEN secret should be deleted from the repo once trusted publishing is confirmed working, so the fallback path can't accidentally become the active auth method (e.g. after an unrelated token rotation) and mask a broken OIDC registration.

Was this helpful? React with 👍 / 👎


- name: Publish to npm
run: npm publish --provenance --access public

@gitar-bot gitar-bot Bot Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Bug: npm publish --provenance conflicts with publishConfig.provenance:false

package.json has "publishConfig": { "provenance": false, ... } (package.json:54), but release.yml's final step runs npm publish --provenance --access public (.github/workflows/release.yml:102). The explicit CLI flag overrides publishConfig, so provenance attestation will be generated even though the package config says it shouldn't be — the opposite of what's declared in package.json, and it may also fail if the repo/workflow isn't OIDC-eligible for provenance (e.g. when only the NPM_TOKEN fallback path is active, --provenance requires id-token: write and a Sigstore-compatible CI, which is satisfied here, but the mismatch with publishConfig is still an inconsistency worth resolving so future edits to one don't silently diverge from the other).

Align publishConfig with the workflow's intent — remove the false override so provenance is enabled consistently, or drop --provenance from the workflow if provenance is intentionally disabled.:

"publishConfig": {
  "access": "public",
  "registry": "https://registry.npmjs.org/"
}

Was this helpful? React with 👍 / 👎

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"rtmp",
"terminal"
],
"author": "WAVE Inc. <sdk@wave.online>",
"author": "WAVE Online, LLC",
"license": "MIT",
"repository": {
"type": "git",
Expand Down
Loading