fix: push git tags and create GitHub Release after npm publish#47
Merged
Conversation
After `pnpm changeset publish` creates local git tags, push them to origin and create a GitHub Release with auto-generated notes. - `git push origin --follow-tags` propagates the version tags - `softprops/action-gh-release@v3.0.0` (SHA-pinned) creates the Release with `generate_release_notes: true` for an auto-generated changelog Permissions already include `contents: write` and `id-token: write` (OIDC provenance) — no permission changes needed.
…tice - Status: note npm publish complete (0.1.0 live); remaining Phase 3 scope = voidpay.xyz cutover only (C1 / vl-app #120) - Packages table: "0.1.0 ready" → "0.1.0 — live on npm" for all three - Quick Install: remove "> Not yet published — Phase 3" blockquote
…ublishing After npm publish + GitHub Release, obtain a short-lived crates.io token via `rust-lang/crates-io-auth-action@v1.0.4` (SHA-pinned, OIDC — no stored API token needed) and run `cargo publish`. Dry-run validation: packaged 106 files (157.5 KiB compressed), verified host build clean in 27s — `--no-verify` not needed; cdylib + wasm-bindgen deps compile fine on the native target. `id-token: write` and `contents: write` permissions unchanged.
Bug 1: `--follow-tags` only pushes annotated tags; changeset publish creates lightweight tags. Switch to `--tags` to push all tags. Bug 2: `softprops/action-gh-release` defaults to `github.ref` on a manual dispatch (a branch ref, not a tag), creating a bogus release. Add a "Derive version" step that reads packages/codec/package.json and exposes `steps.ver.outputs.v`; pass it as `tag_name` to the action. The action is idempotent: it updates an existing release if v0.1.0 already exists (no failure on re-run).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
release.yml): Afterpnpm changeset publish, push the locally-created git tags to origin (git push origin --follow-tags) and create a GitHub Release with auto-generated notes (softprops/action-gh-release@v3.0.0, SHA-pinned). Existing OIDC publish step untouched;contents: write+id-token: writepermissions unchanged.README.md): Remove the "Not yet published — Phase 3" blockquote under Quick Install; update Status to reflect npm publish is done and only voidpay.xyz cutover remains; update packages table from "0.1.0 ready" to "0.1.0 — live on npm".Files changed
.github/workflows/release.yml(+6 lines, 0 deletions)README.md(+4 lines, 6 deletions)Test plan
ci-gate) passes on this PR (no Rust/TS build triggered by these changes — expect fast green)release.ymlYAML indentation and SHA pin match existing action pins in the filepermissions: contents: writeandid-token: writeboth present in workflow