From 3669a40cc2a81ac217ffa1fa412bfbbf2c7c42d2 Mon Sep 17 00:00:00 2001 From: Max Date: Sun, 11 Oct 2026 15:36:33 +0800 Subject: [PATCH] =?UTF-8?q?fix(ci):=20GitHub=20Packages=20=E4=BB=BB?= =?UTF-8?q?=E5=8A=A1=E7=9A=84=E5=86=92=E7=83=9F=E8=BE=93=E5=85=A5=E6=94=B9?= =?UTF-8?q?=E4=BB=8E=E6=A3=80=E5=87=BA=E7=9B=AE=E5=BD=95=E8=AF=BB=E5=8F=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #25 起 npm 包不再包含 examples/，而 publish 任务仍从已安装包里读 examples/jeepay/flowchart.graph.json（第 52、53、74 行），下次发版会在 "Install and verify the candidate" 失败。npmjs 任务本就从检出目录复制示例，不受影响。 - 三处改为读检出目录的 examples/jeepay/flowchart.graph.json - plugin-package 测试断言工作流不再引用包内 examples --- .github/workflows/publish-github-npm.yml | 6 +++--- tests/plugin-package.test.mjs | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish-github-npm.yml b/.github/workflows/publish-github-npm.yml index 052c5fb..8d20fef 100644 --- a/.github/workflows/publish-github-npm.yml +++ b/.github/workflows/publish-github-npm.yml @@ -49,8 +49,8 @@ jobs: run: | npm install --prefix verified --ignore-scripts --no-audit --no-fund --package-lock=false "./publish/supermax92-qgraphflow-$VERSION.tgz" diff -r runtime verified/node_modules/@supermax92/qgraphflow - node verified/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/validate-graph.mjs verified/node_modules/@supermax92/qgraphflow/examples/jeepay/flowchart.graph.json --input-only - node verified/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/generate-viewer.mjs verified/node_modules/@supermax92/qgraphflow/examples/jeepay/flowchart.graph.json output/order + node verified/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/validate-graph.mjs examples/jeepay/flowchart.graph.json --input-only + node verified/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/generate-viewer.mjs examples/jeepay/flowchart.graph.json output/order # Generate the complete real-source Jeepay collection with the installed package. node verified/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/generate-viewer.mjs examples/jeepay/collection.graph.json output/eleven - uses: actions/setup-node@v7 @@ -71,7 +71,7 @@ jobs: cmp "publish/supermax92-qgraphflow-$VERSION.tgz" "downloaded/supermax92-qgraphflow-$VERSION.tgz" npm install --prefix registry-check --registry=https://npm.pkg.github.com --ignore-scripts --no-audit --no-fund --package-lock=false "@supermax92/qgraphflow@$VERSION" diff -r runtime registry-check/node_modules/@supermax92/qgraphflow - node registry-check/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/generate-viewer.mjs registry-check/node_modules/@supermax92/qgraphflow/examples/jeepay/flowchart.graph.json output/registry + node registry-check/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/generate-viewer.mjs examples/jeepay/flowchart.graph.json output/registry # npmjs.com: the Release tarball itself, published through npm trusted publishing (GitHub OIDC) with provenance. # No npm token is stored anywhere; npmjs.com trusts this repository and this workflow file name. diff --git a/tests/plugin-package.test.mjs b/tests/plugin-package.test.mjs index a33893d..a0ddbdf 100644 --- a/tests/plugin-package.test.mjs +++ b/tests/plugin-package.test.mjs @@ -70,6 +70,7 @@ test('the npmjs job publishes the verified Release tarball through trusted publi const away = job.indexOf('cd "$RUNNER_TEMP/npx"'), npx = job.indexOf('npx -y "qgraphflow@$VERSION"'); assert.ok(away > 0 && away < npx, 'npx runs outside the checkout, whose own package.json would shadow the registry package'); assert.doesNotMatch(workflow, /NPM_TOKEN|secrets\./, 'No stored npm token'); + assert.doesNotMatch(workflow, /qgraphflow\/examples\//, 'Examples are not packaged; read them from the checkout'); assert.doesNotMatch(job, /NODE_AUTH_TOKEN|packages: write/); assert.ok(fs.existsSync(path.join(root, 'examples/jeepay/flowchart.graph.json'))); });