fix: harden 0.2 for existing 0.1 consumers (layer order, CLI package, upgrade gaps)

.github/workflows/ci.yml

@@ -78,20 +78,38 @@ jobs:
         run: |
           pnpm run build
           pnpm pack --pack-destination "$RUNNER_TEMP"
-
-      - name: Install the tarball into a clean React project
+          pnpm --filter @lablup/ui-common-cli pack --pack-destination "$RUNNER_TEMP"
+
+      # pnpm, as every consumer installs: pnpm 11 fails the install with
+      # ERR_PNPM_IGNORED_BUILDS when a dependency's build script is neither
+      # allowed nor declined, which npm never reports. fixture/pnpm-workspace.yaml
+      # holds the allowBuilds block a consumer needs, and makes the fixture its
+      # own workspace, apart from this repository's.
+      - name: Install the tarballs into a clean React project
         working-directory: fixture
         run: |
-          TARBALL=$(find "$RUNNER_TEMP" -name 'lablup-ui-common-*.tgz' | head -1)
-          echo "Installing $TARBALL"
-          npm install --no-package-lock "$TARBALL"
-          npm install --no-package-lock
+          LIB=$(find "$RUNNER_TEMP" -name 'lablup-ui-common-[0-9]*.tgz' | head -1)
+          CLI=$(find "$RUNNER_TEMP" -name 'lablup-ui-common-cli-*.tgz' | head -1)
+          echo "Installing $LIB and $CLI"
+          pnpm add "$LIB"
+          pnpm add --save-dev "$CLI"
 
       - name: Type-check and build the fixture against the packed artifact
         working-directory: fixture
         run: |
-          npx tsc --noEmit
-          npx vite build
+          pnpm exec tsc --noEmit
+          pnpm exec vite build
+
+      # The CLI resolves the project's @lablup/ui-common and the Astryx CLI it
+      # pins from two different packages; this runs it where a consumer would.
+      - name: Run the ui-common bin from the fixture
+        working-directory: fixture
+        run: |
+          pnpm exec ui-common --version --verbose
+          pnpm exec ui-common --help > /dev/null
+          pnpm exec ui-common agents > /dev/null
+          pnpm exec ui-common component Button --json > /dev/null
+          pnpm exec ui-common upgrade --from 0.1 --dry-run > /dev/null
 
       # Building is not the same as being styled. 0.1.0-alpha.0 built here
       # green while shipping every component's CSS as an asset nothing could

.github/workflows/publish.yml

@@ -56,39 +56,71 @@ jobs:
       - name: Verify before publishing
         run: pnpm run verify
 
-      - name: Confirm the release tag matches the package version
-        if: github.event_name == 'release'
+      # @lablup/ui-common (the root) and @lablup/ui-common-cli (packages/cli)
+      # are released together at one version: the CLI takes the library as an
+      # exact peer.
+      - name: Confirm both packages are at one version
         run: |
-          PKG_VERSION=$(node -p "require('./package.json').version")
-          TAG="${GITHUB_REF_NAME#v}"
-          if [ "$PKG_VERSION" != "$TAG" ]; then
-            echo "package.json is $PKG_VERSION but the release tag is $TAG" >&2
+          LIB=$(node -p "require('./package.json').version")
+          CLI=$(node -p "require('./packages/cli/package.json').version")
+          if [ "$LIB" != "$CLI" ]; then
+            echo "@lablup/ui-common is $LIB but @lablup/ui-common-cli is $CLI" >&2
             exit 1
           fi
 
+      - name: Confirm the release tag matches the package versions
+        if: github.event_name == 'release'
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          for PKG in package.json packages/cli/package.json; do
+            PKG_VERSION=$(node -p "require('./$PKG').version")
+            if [ "$PKG_VERSION" != "$TAG" ]; then
+              echo "$PKG is $PKG_VERSION but the release tag is $TAG" >&2
+              exit 1
+            fi
+          done
+
+      # Any prerelease goes to `next`, a plain version to `latest`. 0.1's
+      # prereleases went out under `alpha`; that tag is no longer moved.
+      # The registry still sets `latest` on a package's first publish, so
+      # @lablup/ui-common-cli's `latest` is its first alpha until 0.2.0; the
+      # docs say `@next` until then. Do not move `latest` here.
       - name: Choose the dist-tag from the version
         id: tag
         run: |
           VERSION=$(node -p "require('./package.json').version")
           case "$VERSION" in
-            *-alpha*) TAG=alpha ;;
-            *-beta*)  TAG=beta ;;
-            *-rc*)    TAG=rc ;;
-            *-*)      TAG=next ;;
-            *)        TAG=latest ;;
+            *-*) TAG=next ;;
+            *)   TAG=latest ;;
           esac
           echo "Publishing $VERSION under dist-tag $TAG"
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      # pnpm packs both, rewriting the CLI's `workspace:*` peer to the exact
+      # version; the library goes first so the CLI's peer exists when it lands.
+      - name: Pack both packages
+        run: |
+          mkdir -p "$RUNNER_TEMP/packed"
+          pnpm pack --pack-destination "$RUNNER_TEMP/packed"
+          pnpm --filter @lablup/ui-common-cli pack --pack-destination "$RUNNER_TEMP/packed"
+          ls -la "$RUNNER_TEMP/packed"
 
       - name: Publish
         if: github.event_name == 'release' || inputs.dry_run == false
-        run: pnpm publish --no-git-checks --access public --tag ${{ steps.tag.outputs.tag }} --registry https://npm.pkg.github.com
+        run: |
+          for PKG in lablup-ui-common lablup-ui-common-cli; do
+            npm publish "$RUNNER_TEMP/packed/$PKG-${{ steps.tag.outputs.version }}.tgz" --access public --tag ${{ steps.tag.outputs.tag }} --registry https://npm.pkg.github.com
+          done
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Dry run
         if: github.event_name == 'workflow_dispatch' && inputs.dry_run
-        run: pnpm pack && ls -la *.tgz
+        run: |
+          for PKG in lablup-ui-common lablup-ui-common-cli; do
+            npm publish "$RUNNER_TEMP/packed/$PKG-${{ steps.tag.outputs.version }}.tgz" --dry-run --access public --tag ${{ steps.tag.outputs.tag }} --registry https://npm.pkg.github.com
+          done
 
   # GitHub Packages requires authentication even for public packages, so an
   # open-source consumer cannot install from it without every contributor
@@ -130,46 +162,78 @@ jobs:
       - name: Verify before publishing
         run: pnpm run verify
 
-      - name: Confirm the release tag matches the package version
-        if: github.event_name == 'release'
+      # @lablup/ui-common (the root) and @lablup/ui-common-cli (packages/cli)
+      # are released together at one version: the CLI takes the library as an
+      # exact peer.
+      - name: Confirm both packages are at one version
         run: |
-          PKG_VERSION=$(node -p "require('./package.json').version")
-          TAG="${GITHUB_REF_NAME#v}"
-          if [ "$PKG_VERSION" != "$TAG" ]; then
-            echo "package.json is $PKG_VERSION but the release tag is $TAG" >&2
+          LIB=$(node -p "require('./package.json').version")
+          CLI=$(node -p "require('./packages/cli/package.json').version")
+          if [ "$LIB" != "$CLI" ]; then
+            echo "@lablup/ui-common is $LIB but @lablup/ui-common-cli is $CLI" >&2
             exit 1
           fi
 
+      - name: Confirm the release tag matches the package versions
+        if: github.event_name == 'release'
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          for PKG in package.json packages/cli/package.json; do
+            PKG_VERSION=$(node -p "require('./$PKG').version")
+            if [ "$PKG_VERSION" != "$TAG" ]; then
+              echo "$PKG is $PKG_VERSION but the release tag is $TAG" >&2
+              exit 1
+            fi
+          done
+
+      # Any prerelease goes to `next`, a plain version to `latest`. 0.1's
+      # prereleases went out under `alpha`; that tag is no longer moved.
+      # The registry still sets `latest` on a package's first publish, so
+      # @lablup/ui-common-cli's `latest` is its first alpha until 0.2.0; the
+      # docs say `@next` until then. Do not move `latest` here.
       - name: Choose the dist-tag from the version
         id: tag
         run: |
           VERSION=$(node -p "require('./package.json').version")
           case "$VERSION" in
-            *-alpha*) TAG=alpha ;;
-            *-beta*)  TAG=beta ;;
-            *-rc*)    TAG=rc ;;
-            *-*)      TAG=next ;;
-            *)        TAG=latest ;;
+            *-*) TAG=next ;;
+            *)   TAG=latest ;;
           esac
           echo "Publishing $VERSION under dist-tag $TAG"
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      # pnpm packs both, rewriting the CLI's `workspace:*` peer to the exact
+      # version; the library goes first so the CLI's peer exists when it lands.
+      - name: Pack both packages
+        run: |
+          mkdir -p "$RUNNER_TEMP/packed"
+          pnpm pack --pack-destination "$RUNNER_TEMP/packed"
+          pnpm --filter @lablup/ui-common-cli pack --pack-destination "$RUNNER_TEMP/packed"
+          ls -la "$RUNNER_TEMP/packed"
 
       - name: Confirm the credential is valid for npmjs
         run: npm whoami --registry https://registry.npmjs.org
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
-      # npm rather than pnpm here: provenance is an npm CLI feature and this
-      # is the one step that needs it. The tarball is identical either way,
-      # since both pack from the same files allowlist.
+      # npm publishes the tarballs pnpm packed: provenance is an npm CLI
+      # feature, and npm would leave the CLI's `workspace:*` peer unrewritten
+      # if it packed the directory itself.
       - name: Publish
         if: github.event_name == 'release' || inputs.dry_run == false
-        run: npm publish --provenance --access public --tag ${{ steps.tag.outputs.tag }} --registry https://registry.npmjs.org
+        run: |
+          for PKG in lablup-ui-common lablup-ui-common-cli; do
+            npm publish "$RUNNER_TEMP/packed/$PKG-${{ steps.tag.outputs.version }}.tgz" --provenance --access public --tag ${{ steps.tag.outputs.tag }} --registry https://registry.npmjs.org
+          done
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Dry run
         if: github.event_name == 'workflow_dispatch' && inputs.dry_run
-        run: npm publish --dry-run --access public --tag ${{ steps.tag.outputs.tag }} --registry https://registry.npmjs.org
+        run: |
+          for PKG in lablup-ui-common lablup-ui-common-cli; do
+            npm publish "$RUNNER_TEMP/packed/$PKG-${{ steps.tag.outputs.version }}.tgz" --dry-run --access public --tag ${{ steps.tag.outputs.tag }} --registry https://registry.npmjs.org
+          done
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.gitignore

@@ -7,3 +7,4 @@ coverage/
 .eslintcache
 fixture/node_modules/
 fixture/dist/
+fixture/pnpm-lock.yaml

.prettierignore

@@ -3,5 +3,5 @@ coverage/
 pnpm-lock.yaml
 LICENSE
 src/theme/*/built/
-test/upgrade/fixtures/
+packages/cli/test/upgrade/fixtures/
 .claude/