From 9a3fc3ec06c96bdfd44bd9ab1ea3421290f6f7a4 Mon Sep 17 00:00:00 2001
From: Lane Sawyer <lane.sawyer@alleninstitute.org>
Date: Tue, 5 May 2026 15:51:11 -0700
Subject: [PATCH 1/2] trying to get this set up like we want

---
 .github/workflows/publish.yml | 50 +++++++++----------
 .github/workflows/release.yml | 91 +++++++++++++++++++++++++++++++++++
 cliff.toml                    |  2 +-
 3 files changed, 114 insertions(+), 29 deletions(-)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f8ff0293..9b11e44c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,39 +3,25 @@ name: Publish to NPM
 on:
     push:
         tags:
-            - '*/v*.*.*'
-    workflow_dispatch:
-        inputs:
-            package:
-                description: 'Package to publish (core, dzi, geometry, omezarr, scatterbrain, or "all")'
-                required: true
-                default: 'all'
-                type: choice
-                options:
-                    - all
-                    - core
-                    - dzi
-                    - geometry
-                    - omezarr
-                    - scatterbrain
+            # Matches per-package release tags: @alleninstitute/vis-{pkg}@{semver}
+            - '@alleninstitute/vis-*@*.*.*'
 
 jobs:
     publish:
-        name: Publish packages to NPM
+        name: Publish to NPM
         runs-on: ubuntu-latest
+        timeout-minutes: 15
         permissions:
             contents: read
-            id-token: write # Required for npm OIDC provenance
+            id-token: write # Required for npm OIDC trusted publishing
         steps:
             - uses: actions/checkout@v6
 
-            - name: Install pnpm
-              uses: pnpm/action-setup@v6
+            - uses: pnpm/action-setup@v6
               with:
                   version: 10.33.0
 
-            - name: Use Node.js
-              uses: actions/setup-node@v6
+            - uses: actions/setup-node@v6
               with:
                   node-version: 24.15.0
                   registry-url: 'https://registry.npmjs.org'
@@ -47,10 +33,18 @@ jobs:
             - name: Build
               run: pnpm build
 
-            - name: Publish all packages
-              if: github.event_name == 'push' || inputs.package == 'all'
-              run: pnpm -r publish --no-git-checks --access public --provenance
-
-            - name: Publish single package
-              if: github.event_name == 'workflow_dispatch' && inputs.package != 'all'
-              run: pnpm --filter "@alleninstitute/vis-${{ inputs.package }}" publish --no-git-checks --access public --provenance
+            - name: Determine package directory
+              id: pkg
+              shell: bash
+              run: |
+                  REF="${{ github.ref_name }}"
+                  if [[ "$REF" =~ ^@alleninstitute/vis-([^@]+)@[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+                      echo "pkg_dir=packages/${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
+                  else
+                      echo "::error::Unexpected tag format: ${REF}"
+                      exit 1
+                  fi
+
+            - name: Publish
+              working-directory: ${{ steps.pkg.outputs.pkg_dir }}
+              run: npm publish --access public --provenance
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..8f9cc07f
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,91 @@
+name: Release
+
+on:
+    workflow_dispatch:
+        inputs:
+            package:
+                description: 'Package to release'
+                required: true
+                type: choice
+                options:
+                    - core
+                    - dzi
+                    - geometry
+                    - omezarr
+                    - scatterbrain
+
+jobs:
+    release:
+        name: Bump version, update changelog, tag, and push
+        runs-on: ubuntu-latest
+        timeout-minutes: 15
+        steps:
+            - uses: actions/checkout@v6
+              with:
+                  ref: ${{ github.event.repository.default_branch }}
+                  ssh-key: ${{ secrets.SERVICE_ACCOUNT_SSH_KEY }}
+                  fetch-depth: 0
+
+            - uses: pnpm/action-setup@v6
+              with:
+                  version: 10.33.0
+
+            - uses: actions/setup-node@v6
+              with:
+                  node-version: 24.15.0
+
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+
+            - name: Set git user
+              run: |
+                  git config user.name 'svcbrainwebgh'
+                  git config user.email 'svcbrainwebgh@alleninstitute.org'
+
+            - name: Get bumped version
+              run: |
+                  PKG="${{ inputs.package }}"
+                  FULL_TAG=$(pnpm exec git-cliff \
+                      --tag-pattern "@alleninstitute/vis-${PKG}@*" \
+                      --include-path "packages/${PKG}/**" \
+                      --bumped-version 2>/dev/null)
+
+                  if [[ ! "$FULL_TAG" =~ ^@alleninstitute/vis-[^@]+@[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+                      echo "::error::Unexpected git-cliff output: '${FULL_TAG}'"
+                      exit 1
+                  fi
+                  if git rev-parse "$FULL_TAG" >/dev/null 2>&1; then
+                      echo "::error::Tag ${FULL_TAG} already exists."
+                      exit 1
+                  fi
+
+                  echo "BUMPED_TAG=${FULL_TAG}" >> $GITHUB_ENV
+                  echo "BUMPED_VERSION=${FULL_TAG##*@}" >> $GITHUB_ENV
+
+            - name: Update version number
+              run: npm pkg set version="${{ env.BUMPED_VERSION }}" --prefix "packages/${{ inputs.package }}"
+
+            - name: Generate changelog
+              uses: orhun/git-cliff-action@v4
+              with:
+                  config: cliff.toml
+                  args: >-
+                      --tag-pattern "@alleninstitute/vis-${{ inputs.package }}@*"
+                      --include-path "packages/${{ inputs.package }}/**"
+                      --tag "${{ env.BUMPED_TAG }}"
+              env:
+                  OUTPUT: packages/${{ inputs.package }}/CHANGELOG.md
+
+            - name: Commit package.json and changelog
+              run: |
+                  git add "packages/${{ inputs.package }}/package.json" \
+                          "packages/${{ inputs.package }}/CHANGELOG.md"
+                  git commit -m "chore(release): ${{ env.BUMPED_TAG }}"
+
+            - name: Create tag
+              run: git tag -a "${{ env.BUMPED_TAG }}" -m "${{ env.BUMPED_TAG }}"
+
+            - name: Push
+              run: |
+                  git push
+                  git push origin tag "${{ env.BUMPED_TAG }}"
diff --git a/cliff.toml b/cliff.toml
index 4c5c77d2..da886501 100644
--- a/cliff.toml
+++ b/cliff.toml
@@ -15,7 +15,7 @@ All notable changes to this project will be documented in this file.\n
 # https://keats.github.io/tera/docs/#introduction
 body = """
 {% if version %}\
-    ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
+    ## [{{ version | split(pat="@") | last | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
 {% else %}\
     ## [unreleased]
 {% endif %}\

From afe87a1abd12bc7c2710a54f27951fd36f82759a Mon Sep 17 00:00:00 2001
From: Lane Sawyer <lane.sawyer@alleninstitute.org>
Date: Wed, 6 May 2026 13:12:26 -0700
Subject: [PATCH 2/2] tweak publish.yml

---
 .github/workflows/publish.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9b11e44c..b0674711 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -8,20 +8,22 @@ on:
 
 jobs:
     publish:
-        name: Publish to NPM
+        name: Publish package to NPM
         runs-on: ubuntu-latest
         timeout-minutes: 15
         permissions:
             contents: read
-            id-token: write # Required for npm OIDC trusted publishing
+            id-token: write # Required for npm OIDC provenance
         steps:
             - uses: actions/checkout@v6
 
-            - uses: pnpm/action-setup@v6
+            - name: Install pnpm
+              uses: pnpm/action-setup@v6
               with:
                   version: 10.33.0
 
-            - uses: actions/setup-node@v6
+            - name: Use Node.js
+              uses: actions/setup-node@v6
               with:
                   node-version: 24.15.0
                   registry-url: 'https://registry.npmjs.org'