release: add npm publish workflow (OIDC trusted publishing) - #11
Merged
Conversation
Publishes @feralfile/source-resolver to npm on GitHub release, modeled on ff-cli's release pipeline: reuse CI via workflow_call, verify the tag matches package.json (bare tags, no v prefix), publish with provenance, then verify the registry version. The publish step is idempotent so the bootstrap release (first publish done manually while wiring the trusted publisher) can still get a normal release run. Bump version to 1.0.0: the library is stable and in production use as ff-cli's find backend.
Contributor
Author
|
Note on the red check: Live Resolver Fixtures is a pre-existing failure, not from this PR — the nightly scheduled runs on |
npm cannot configure a trusted publisher for a package that does not exist yet (npm/cli#8544), so the first publish authenticates with an NPM_TOKEN repo secret when present — the same token-era ff-cli used before its OIDC switch (ff-cli #61). Once the package exists and the trusted publisher is wired, delete the secret; the workflow then publishes via OIDC with no further change. Also merges main (raster GraphQL fallback + fixture fixes, #12) so this branch's CI reflects the healed live suite.
3 tasks
ngleanh
added a commit
to feral-file/ff-cli
that referenced
this pull request
Jul 27, 2026
…#96) * deps: swap @feralfile/source-resolver git URL for npm registry semver Blocked on the resolver's first npm publish (feral-file/ff-source-resolver#11). npm 12 defaults allow-git=none, so the git-URL dependency breaks npm i -g @feralfile/cli for end users and npm ci for contributors. After the registry publish lands, regenerate package-lock.json with npm install and drop the README allow-git workaround note (done here). Note: ^1.0.0 is cut from current resolver main, two merges ahead of the old commit pin (playable artwork source resolution + hardening). * chore(deps): refresh source resolver lockfile --------- Co-authored-by: Anh Nguyen <ngleanh@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a Release workflow that publishes
@feralfile/source-resolverto npm on GitHub release, modeled on ff-cli's pipeline: CI reuse viaworkflow_call, tag↔package.jsonversion check (bare tags, novprefix),npm publish --provenance, and a registry verification pass. Bumps the package to 1.0.0 — the library is stable and in production as ff-cli'sfindbackend.Why
ff-cli depends on this repo as a git-URL dependency, and npm 12's supply-chain defaults (
allow-git=none) refuse git deps — sonpm i -g @feralfile/clicurrently fails outright for npm 12 users, and ff-cli contributors need--allow-git=allto install. Publishing the resolver to the registry and swapping ff-cli's dep to a semver range fixes both without weakening npm's protections. Companion PR: feral-file/ff-cli#96.Publish auth
Releases are fully automated (create a GitHub release → workflow publishes), following ff-cli's two-era arc:
NPM_TOKENrepo secret when present — the same token-based auth ff-cli's releases used before its OIDC switch (ff-cli #61). One-time setup: create a granular automation token with publish rights on the@feralfilescope and add it as theNPM_TOKENsecret on this repo.feral-file, repoff-source-resolver, workflowrelease.yml) and delete the secret. The workflow detects the absent token and publishes via OIDC — no workflow change needed.The publish step is idempotent: re-running a release for an already-published version verifies instead of failing.
Testing
npm run verifygreen (175/175) with the branch synced to main (includes raster: fall back to GraphQL slug lookup when the artwork page is bot-challenged #12's raster fix + fixture hardening, so this PR's live CI reflects the healed suite).