Set up npm release: publish-on-tag workflow + package hardening - #20
Merged
Conversation
- package.json hardened for publishing:
- bin -> src/cli.ts. codeoid is Bun-native (bun runs TS directly); the
bundled dist/cli.js broke the web/dist path resolution, so we ship source.
- files allowlist: src (minus tests) + prebuilt web/dist (minus sourcemaps)
+ README/LICENSE/CONTRIBUTING/SECURITY + docs/architecture.png.
- engines.bun, repository/homepage/bugs/keywords, prepublishOnly builds web.
- web/.npmignore so the nested web/.gitignore doesn't strip web/dist from the
published tarball.
- .github/workflows/release.yml: on a v* tag, build the web UI, run tests,
verify the tag matches package.json, npm publish --provenance, GitHub Release.
- CHANGELOG.md (0.1.0) + RELEASING.md runbook (add NPM_TOKEN, push a tag).
Validated with `npm pack --dry-run`: 10.5 MB unpacked, ships src + web/dist,
no test files or sourcemaps.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First half of release setup (npm). The Rust crates + binary releases for
codeoid-uiare a separate PR.What this adds
.github/workflows/release.yml— on avX.Y.Ztag: build web UI → run tests → assert tag ==package.jsonversion →npm publish --provenance→ GitHub Release.bin→src/cli.ts(codeoid is Bun-native; bun runs TS directly, and the bundleddist/cli.jsbroke theweb/distpath resolution — so we ship source).filesallowlist:src(minus tests) + prebuiltweb/dist(minus sourcemaps) + docs/LICENSE/etc.engines.bun,repository/homepage/bugs/keywords,prepublishOnlybuilds the web UI.web/.npmignore— neutralizes the nestedweb/.gitignoresoweb/distactually ships (validated: it was being silently stripped).To cut the release (after merge)
NPM_TOKENrepo secret (npm automation token with publish rights).git tag v0.1.0 && git push origin v0.1.0→ installs asbun install -g codeoid.Validated with
npm pack --dry-run: 10.5 MB unpacked, shipssrc+web/dist, no tests/maps. Docs-and-config only; thedaemon/webchecks still run.🤖 Generated with Claude Code