Skip to content

v0.1.4

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Feb 00:31
· 3 commits to main since this release
v0.1.4
91c6d90
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

docprims v0.1.4

Release Date: 2026-01-31
Status: Patch Release (Go rpath + TypeScript OIDC fixes)

Summary

This release improves Go shared library developer experience and applies npm OIDC publishing fixes learned from sysprims.

Highlights

  • Go shared library rpath: Local builds no longer require LD_LIBRARY_PATH/DYLD_LIBRARY_PATH
  • TypeScript npm OIDC fixes: Workflow now correctly uses OIDC trusted publishing
  • ADR-0006: Documents TypeScript npm publishing standard

Go Shared Library Improvement

The Change

v0.1.4 embeds -Wl,-rpath entries in cgo LDFLAGS for shared library builds on darwin-arm64, linux-amd64, and linux-arm64. This embeds the vendored lib-shared/ directories in the binary's library search path.

Before v0.1.4

# Required environment variable for local development
DYLD_LIBRARY_PATH=./lib-shared/darwin-arm64 go run .  # macOS
LD_LIBRARY_PATH=./lib-shared/linux-amd64 go run .     # Linux

v0.1.4+

# Just works - rpath is embedded
go run .
go build -tags docprims_shared .

Distribution Guidance

For distributing binaries, prefer bundling the shared library next to your executable and embedding a platform-appropriate rpath:

Platform Rpath Pattern
macOS @executable_path
Linux $ORIGIN

Example:

# Build with custom rpath for distribution
go build -ldflags="-r @executable_path" -tags docprims_shared .

TypeScript npm OIDC Publishing Fixes

Issues Addressed

The npm publish workflow had several issues preventing OIDC trusted publishing from working:

  1. npm CLI too old: Ubuntu runners with Node 20 ship npm ~10.x, which lacks OIDC support
  2. Token interference: actions/setup-node with registry-url creates .npmrc that can interfere with OIDC
  3. git fetch conflict: fetch-tags: true causes errors when running from a tag ref
  4. Transient failures: Artifact downloads occasionally fail on GitHub-hosted runners

Fixes Applied

# 1. Upgrade npm to version with OIDC support
- name: Ensure npm CLI supports OIDC
  run: npm install -g npm@11.5.1

# 2. Force OIDC mode in publish steps
- name: Publish
  run: |
    unset NODE_AUTH_TOKEN NPM_TOKEN
    export NPM_CONFIG_USERCONFIG="$RUNNER_TEMP/npmrc-oidc"
    printf '%s\n' 'registry=https://registry.npmjs.org/' 'always-auth=false' > "$NPM_CONFIG_USERCONFIG"
    npm publish --access public

# 3. Remove fetch-tags from checkout
- uses: actions/checkout@v4  # No fetch-tags option

# 4. Add retry logic for artifact download
for attempt in 1 2 3 4 5; do
  if gh run download "${RUN_ID}" --name ts-npm-dir --dir npm-packages; then
    break
  fi
  sleep $((attempt * attempt))
done

ADR-0006

This release adds ADR-0006 documenting the TypeScript npm publishing standard, including:

  • OIDC trusted publishing configuration
  • Force OIDC mode pattern
  • Release workflow order requirements
  • First-publish manual bootstrap process

See docs/decisions/ADR-0006-typescript-npm-publishing.md for details.

Changelog

See CHANGELOG.md for detailed changes.

Assets 20
Loading