Skip to content

Add CI and npm-publish workflows#5

Merged
schani merged 3 commits into
mainfrom
ci
Jul 20, 2026
Merged

Add CI and npm-publish workflows#5
schani merged 3 commits into
mainfrom
ci

Conversation

@schani

@schani schani commented Jul 20, 2026

Copy link
Copy Markdown
Member

Adds GitHub Actions for CI and npm publishing.

CI (ci.yml)

Runs on pull requests and on pushes to main:

  • npm run typechecktsc under the project's strict config (the repo has no separate linter; this is the lint gate)
  • npm run build — tsdown
  • npm test — 138 tests via the Node test runner

Uses Node 24, which satisfies tsdown's engine requirement (^22.18.0 || >=24.11.0).

Publish (publish.yml)

Runs when a GitHub release is published:

  1. Runs typecheck and tests
  2. Sets the package version from the release tag, stripping a leading v (so a release tagged v0.5.0 publishes 0.5.0)
  3. npm publish --provenance (the prepublishOnly hook runs the build)

Details:

  • Auth via npm trusted publishing (OIDC) — no token secret. Requires a trusted publisher configured on the npm package pointing at this repo and publish.yml (see below).
  • Prereleases (releases marked "pre-release" on GitHub) publish to the next dist-tag instead of latest.
  • Publishing generates npm provenance, so the npm page shows verifiable build attestation.
  • All actions are pinned to commit SHAs (currently v7.0.0 of checkout and setup-node).

Setup required (one-time, on npmjs.com)

On the determined package: Settings → Trusted Publisher → GitHub Actions, with organization glideapps, repository determined, workflow filename publish.yml, environment left empty.

🤖 Generated with Claude Code

schani and others added 3 commits July 20, 2026 09:15
CI runs typecheck, build, and tests on pull requests and on pushes to
main. Publish runs when a GitHub release is published: it sets the
package version from the release tag (stripping a leading v), runs the
checks, and publishes to npm with provenance. Prereleases go to the
"next" dist-tag so they never become npm's "latest". Actions are
pinned to commit SHAs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
npm version errors on a no-op change, which would fail the very first
release: package.json is already at 0.4.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@schani
schani merged commit a35c877 into main Jul 20, 2026
1 check passed
@schani
schani deleted the ci branch July 20, 2026 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant