setup: npm publish (changesets + release workflow)#8
Open
Conversation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ウォークスルーChangesets ツールを導入して、npm へのリリースワークフローを整備しました。設定ファイル、GitHub Actions ワークフロー、npm スクリプト、およびドキュメントを追加して、自動化されたパッケージ公開プロセスを実装しています。 変更内容
推定コードレビュー時間🎯 2 (Simple) | ⏱️ ~10 minutes ウサギからのお祝い詩
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
package.json (1)
4-4:⚠️ Potential issue | 🔴 Critical
private: trueが公開リリースをブロックしますLine 4 はこのPRの「npm publish 設定」目的と衝突しています。公開対象がこのパッケージなら
privateをfalseに変更してください（private のままなら publish されません）。🔧 修正案
- "private": true, + "private": false,🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` at line 4, The package.json has "private": true which prevents npm publish; to allow public release change the "private" field value to false (or remove the "private" property entirely) so the package can be published; locate the "private" key in package.json and update it accordingly and ensure any CI/publish scripts expect a non-private package.
🧹 Nitpick comments (2)
README.md (1)
41-45: Secrets 設定導線の表記を最新UIに合わせると親切です初回セットアップの迷いを減らすため、
Settings → SecretsをSettings → Secrets and variables → Actions表記に寄せるのを推奨します。🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` around lines 41 - 45, Update the README guidance that currently says "Settings → Secrets" to the current UI path "Settings → Secrets and variables → Actions" so users can find where to add the `NPM_TOKEN` secret; specifically, change the header/inline text where "Settings → Secrets" appears and keep the rest of the table (Secret 名 / `NPM_TOKEN`) untouched so the table under the new UI path remains correct and clear for first-time setup..github/workflows/release.yml (1)
19-21: GitHub Actions をコミット SHA で固定することを推奨します現在、すべての GitHub Actions が
@v4や@v1などのバージョンタグで指定されています。将来のタグ更新によって予期しない変更が導入される可能性があります。再現性の確保と供給網リスク低減のため、40文字のコミット SHA で固定することを推奨します：
- 行19:
actions/checkout@v4- 行20:
pnpm/action-setup@v4- 行21:
actions/setup-node@v4- 行27:
changesets/action@v1🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/release.yml around lines 19 - 21, Replace the three action version tags and the changesets action tag in the workflow with their 40-character commit SHAs to pin exact commits: update the uses entries for actions/checkout, pnpm/action-setup, actions/setup-node, and changesets/action in release.yml so they use the full commit SHA instead of `@v4` or `@v1`; locate the uses lines mentioning those repository names and substitute the tag with the corresponding commit SHA obtained from each action's GitHub repo to ensure reproducible runs.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release.yml:
- Around line 14-17: Remove the unused OIDC permission by deleting the
"id-token: write" entry from the workflow permissions block (the permissions:
contents/pull-requests entries should remain); also scan the steps referenced by
the workflow to confirm no actions rely on OIDC (no usages of GITHUB_OIDC_TOKEN
or provenance signatures) before committing the change to ensure no breakage.
---
Outside diff comments:
In `@package.json`:
- Line 4: The package.json has "private": true which prevents npm publish; to
allow public release change the "private" field value to false (or remove the
"private" property entirely) so the package can be published; locate the
"private" key in package.json and update it accordingly and ensure any
CI/publish scripts expect a non-private package.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 19-21: Replace the three action version tags and the changesets
action tag in the workflow with their 40-character commit SHAs to pin exact
commits: update the uses entries for actions/checkout, pnpm/action-setup,
actions/setup-node, and changesets/action in release.yml so they use the full
commit SHA instead of `@v4` or `@v1`; locate the uses lines mentioning those
repository names and substitute the tag with the corresponding commit SHA
obtained from each action's GitHub repo to ensure reproducible runs.
In `@README.md`:
- Around line 41-45: Update the README guidance that currently says "Settings →
Secrets" to the current UI path "Settings → Secrets and variables → Actions" so
users can find where to add the `NPM_TOKEN` secret; specifically, change the
header/inline text where "Settings → Secrets" appears and keep the rest of the
table (Secret 名 / `NPM_TOKEN`) untouched so the table under the new UI path
remains correct and clear for first-time setup.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (5)
.changeset/README.md.changeset/config.json.github/workflows/release.ymlREADME.mdpackage.json
Comment on lines
+14
to
+17
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| id-token: write |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Search for OIDC/provenance usage patterns
rg -n 'id-token|ACTIONS_ID_TOKEN|provenance|sigstore|cosign' .github/workflows/release.yml README.md package.json .changeset/config.json 2>/dev/null || echo "No matches found"Repository: plainbrew/next-utils
Length of output: 118
🏁 Script executed:
#!/bin/bash
# Check the full release.yml to understand the workflow context
head -100 .github/workflows/release.ymlRepository: plainbrew/next-utils
Length of output: 799
🏁 Script executed:
#!/bin/bash
# Search for any usage of id-token in the entire workflows directory
rg -n 'id-token' .github/workflows/ 2>/dev/null || echo "No id-token usage found"Repository: plainbrew/next-utils
Length of output: 118
🏁 Script executed:
#!/bin/bash
# Check if there are any npm publish or package registry operations that might need id-token
rg -n 'npm publish|registry|provenance' .github/workflows/release.yml 2>/dev/null || echo "No npm publish found"Repository: plainbrew/next-utils
Length of output: 117
id-token: write は使用されていないため削除してください
このワークフローは npm レジストリへの認証に NODE_AUTH_TOKEN 環境変数を使用しており、OIDC トークンは利用されていません。provenance 署名やその他の OIDC ベースの操作も存在しないため、この権限は不要です。最小権限の原則に従い削除してください。
修正例
permissions:
contents: write
pull-requests: write
- id-token: write📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| permissions: | |
| contents: write | |
| pull-requests: write | |
| id-token: write | |
| permissions: | |
| contents: write | |
| pull-requests: write |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/release.yml around lines 14 - 17, Remove the unused OIDC
permission by deleting the "id-token: write" entry from the workflow permissions
block (the permissions: contents/pull-requests entries should remain); also scan
the steps referenced by the workflow to confirm no actions rely on OIDC (no
usages of GITHUB_OIDC_TOKEN or provenance signatures) before committing the
change to ensure no breakage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #5
変更内容
@changesets/cli/@changesets/configをインストールversion/releaseスクリプトを追加.changeset/config.jsonを設定（access: public）changesets/action使用）補足
npm publish には
NPM_TOKENの Secret 設定が別途必要です。Summary by CodeRabbit
New Features
Documentation