Add publication workflow for npmjs.com

[jdmarshall]

First stab at release workflow.

[jdmarshall]

Two things with this. First, that project doesn't yet exist in npmjs.org and I don't have the rights to create it so I'm getting a 404.

Second, the NPM_TOKEN needs to be set in secrets and I don't know if it's there or not.

[krajorama]

Hi, thanks for starting on this, I think the release should be triggered on tag push. I've let Claude take a look and it pointed out a bunch of stuff. Here's its version:

---
name: Publish to npmjs.com

on:
  push:
    tags:
      - 'v*'

permissions: {}

jobs:
  publish:
    environment: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # required for npm publish --provenance

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Use Node.js LTS
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: lts/*
          registry-url: 'https://registry.npmjs.org'

      - name: Verify release secrets
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          if [ -z "${NODE_AUTH_TOKEN}" ]; then
            echo "::error::NPM_TOKEN secret is not set for the 'release' environment."
            exit 1
          fi

      - name: Verify tag matches package.json version
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          PKG_VERSION="$(node -p "require('./package.json').version")"
          if [ "${TAG}" != "${PKG_VERSION}" ]; then
            echo "::error::Tag ${GITHUB_REF_NAME} (${TAG}) does not match package.json version (${PKG_VERSION})."
            exit 1
          fi
          echo "Publishing version ${PKG_VERSION}"

      - name: Determine npm dist-tag
        id: disttag
        run: |
          PKG_VERSION="$(node -p "require('./package.json').version")"
          if [[ "${PKG_VERSION}" == *-* ]]; then
            TAG="$(echo "${PKG_VERSION}" | sed -E 's/^[0-9]+\.[0-9]+\.[0-9]+-([0-9A-Za-z-]+).*/\1/')"
          else
            TAG="latest"
          fi
          echo "tag=${TAG}" >> "${GITHUB_OUTPUT}"
          echo "Using dist-tag: ${TAG}"

      - run: npm i
      - run: npm test
      - run: npm publish --provenance --access public --tag "${{ steps.disttag.outputs.tag }}"
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

[krajorama]

@jdmarshall I've lost access to NPM as it enforced 2FA - I've asked in the CNCF slack for the Prometheus team for help with it. I think once we get through these initial pain, we'll be fine!

[krajorama]

@jdmarshall I've lost access to NPM as it enforced 2FA - I've asked in the CNCF slack for the Prometheus team for help with it. I think once we get through these initial pain, we'll be fine!

@jdmarshall Got the access. However I cannot create the prometheus organization on npmjs as it's taken by a package last published 13 years ago: https://www.npmjs.com/package/prometheus

We're looking into resolving the conflict.

[jdmarshall]

They don't allow namespaces and packages to overlap? Odd, since they're handled unambiguously.

[krajorama]

They don't allow namespaces and packages to overlap? Odd, since they're handled unambiguously.

Nope, I tried creating the namespace and I got an error. However the author of the conflicting package graciously offered to help, see shubik/prometheus_deprecated#20

[jdmarshall]

good deal

[zbjornson]

Are you planning to remove --tag alpha once v16 is ready to go?

#782 (review) had some fancier tag logic.

[jdmarshall]

Yep. That seemed to be the simplest solution. Push alphas until we are ready to publish.

Until or unless there's a major upheaval of the code, say for native histograms, there's no need to do anything but trunk-based releases that I can see.