[BRE-2094] Update CD workflow and add Publish workflow - #142
Conversation
🤖 Bitwarden Claude Code ReviewOverall Assessment: APPROVE Reviewed the CD workflow rewrite and the new inert publish shim. The Code Review Details
|
There was a problem hiding this comment.
Pull request overview
This PR adjusts the release automation for passwordless-nodejs by changing the CD workflow to attach a build artifact to GitHub Releases and adding a dedicated Publish workflow intended for secure npm publishing with provenance.
Changes:
- Added a new
publish.ymlworkflow that delegates publishing to a centralized reusable workflow. - Updated
cd.ymlto build on release publish and upload a zipped build artifact to the GitHub Release. - Added a guard to verify
package.jsonversion alignment with the release tag before building/uploading.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/publish.yml | Adds a minimal publish shim that calls a centralized reusable workflow with OIDC permissions. |
| .github/workflows/cd.yml | Replaces prior deployment dispatch logic with building and uploading a release asset, plus a version/tag verification step. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| run: | | ||
| zip -r "passwordless-nodejs-${RELEASE_TAG}-npm-build.zip" dist |
| contents: read | ||
| id-token: write | ||
| uses: bitwarden/gh-actions/.github/workflows/_publish-passwordless-nodejs-npm.yml@main |
| run: | | ||
| PKG_VERSION=$(jq -r '.version' package.json) | ||
| if [[ "$PKG_VERSION" != "$RELEASE_TAG" ]]; then | ||
| echo "::error::package.json version '${PKG_VERSION}' does not match release tag '${RELEASE_TAG}'" | ||
| exit 1 | ||
| fi |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| - name: Verify package.json version matches release tag | ||
| env: | ||
| RELEASE_TAG: ${{ github.event.release.tag_name }} | ||
| run: | | ||
| PKG_VERSION=$(jq -r '.version' package.json) | ||
| if [[ "$PKG_VERSION" != "$RELEASE_TAG" ]]; then | ||
| echo "::error::package.json version '${PKG_VERSION}' does not match release tag '${RELEASE_TAG}'" | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
❓ QUESTION: Does the release process now include bumping package.json before tagging?
Context
package.json has been pinned at 1.0.0 since the initial commit (git log -S '"version"' -- package.json shows no bumps), yet tags 1.0.1 and 1.0.1-beta.1 exist. The old flow passed the version downstream explicitly (--field version="${TAG_NAME}"), so the in-repo version never had to match.
With this gate, the next release tagged anything other than 1.0.0 fails here and no asset is attached, blocking publish. That is fine if a version-bump PR is now part of the release runbook — just confirming that step exists, since nothing in this repo automates it.
🎟️ Tracking
BRE-2094
📔 Objective
This PR updates the
CDworkflow to attach the build asset to the GitHub release. ThePublishworkflow was also added as part of the process to securely publish the package on NPM with provenance.