ci(release): enable npm publish, create GitHub Releases on tag, add gated Homebrew bump job - #98
Merged
Merged
Conversation
…ated Homebrew bump job Remove the if: false that has disabled the publish job since its introduction (the reason the repo has 17 tags and zero GitHub Releases). Publishing authenticates with a granular NPM_TOKEN scoped to @deepl/cli for the first publish, keeping --provenance; the switch to OIDC trusted publishing happens after the package exists on npmjs.com. Add an independent release job that creates a GitHub Release from the pushed tag with notes extracted from that version's CHANGELOG section (verified against the real CHANGELOG; missing sections fall back to --generate-notes). The jobs are deliberately not chained so a failure in one cannot suppress the other. Add a homebrew formula-bump job (tarball sha256 + version PR against DeepL/homebrew-tap) gated with if: false until the tap repo and its cross-repo HOMEBREW_TAP_TOKEN exist. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Turns the tag-triggered release pipeline on (sync-8mqh.5). The npm publish job has been hard-disabled (
if: false) since its introduction — which is also why the repo has 17 annotated tags and zero GitHub Releases. After this PR, pushing av*tag publishes to npm with provenance AND creates a GitHub Release, as two independent jobs.Changes Made
publishjob — removedif: false. Authenticates via a granularNPM_TOKENsecret scoped to@deepl/cli(required for the FIRST publish; npm's OIDC trusted-publishing config lives in package settings, so the package must exist before OIDC can be configured — switch and revoke the token afterwards).--provenanceretained; the job already grantsid-token: write.releasejob (new) — creates a GitHub Release from the pushed tag (gh release create --verify-tag), with notes extracted from that version's CHANGELOG section via awk; if the section is missing it falls back to--generate-notes. Runs withcontents: write, independent ofpublishby design: a publish failure cannot suppress the Release and vice versa. Compatible with release immutability (assets/tag freeze at publish; notes stay editable).homebrewjob (new, gatedif: false) — downloads the published registry tarball, computes its sha256, and opens a version-bump PR againstDeepL/homebrew-tap. Gated until the tap repo and a cross-repoHOMEBREW_TAP_TOKENfine-grained PAT exist (the defaultgithub.tokencannot push cross-repo); the gate and enable instructions are documented in the workflow comment.Publish to npm→Releaseto reflect its wider role.actions/checkout/actions/setup-node(already allowlisted) plus the runner'sghCLI — no new third-party actions, which matters since repo Actions permissions are set to "selected".Test Coverage
Workflow logic is not unit-testable from jest, so the fragile pieces were verified directly:
1.2.0) yields exactly its section; an absent version yields empty output, triggering the--generate-notesfallback.Backward Compatibility
✅ No runtime/user-facing behavior changes — CI-only.
⚠️ Operational prerequisite: the
NPM_TOKENrepo secret must exist before the v2.0.0 tag is pushed, or the publish job fails (the Release job still runs, by design).Size: Small ✓
One workflow file; the risk is operational (first firing at tag time), mitigated by job independence and the gated Homebrew job.
🤖 Generated with Claude Code