Skip to content

1.0.5 — GitHub Actions workflow improvements and safer npm publishing automation

Choose a tag to compare

View all tags
@tobrien tobrien released this 01 Feb 02:18
· 11 commits to working since this release
v1.0.5
a77cddb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

1.0.5 focuses on CI/CD reliability and publishing safety. The code/API surface of the package is unchanged; updates are primarily to GitHub Actions workflows and release automation.

CI: test workflow updates

  • Broader branch coverage for CI runs: tests now run on pushes to main, working, and common branch patterns (release/**, feature/**, dependabot/**), plus PRs targeting main.
  • Faster, less wasteful CI with concurrency control: in-progress test runs are canceled when new commits land on the same branch/ref (concurrency with cancel-in-progress: true).
  • More reliable dependency installation in CI:
    • Forces use of the public npm registry (useful when package-lock.json is not committed).
    • Performs a clean install (rm -rf node_modules package-lock.json then npm install --force) to reduce issues with platform-specific optional dependencies (e.g., native Rollup bindings).
  • Standardized Node version for CI: workflows explicitly use Node.js 24.

CD: npm publish workflow improvements

  • Auto-publish from working branch pushes (pre-releases only):
    • If package.json contains a prerelease version (contains -), the workflow will publish using the dev npm dist-tag.
    • The published prerelease version is rewritten to include a timestamp and short SHA to avoid collisions (format: X.Y.Z-dev.YYYYMMDDHHMMSS.<sha>).
  • Protection against accidental production publishes:
    • If the version is a production version (no -), publishes only occur for GitHub Release events.
    • Production-version pushes to working will skip publishing.
  • Publishing uses npm’s public registry and installs npm latest before publishing (when a publish is actually happening).

Repo maintenance

  • Removed .github/dependabot.yml (Dependabot configuration has been deleted).
  • Version updated to 1.0.5 in package.json.

Breaking changes

  • None detected (no runtime/library API changes in this release).
  • Operational note: if you relied on Dependabot updates via this repository’s config, you’ll need to reintroduce .github/dependabot.yml or manage dependency updates another way.
Assets 2
Loading