Skip to content

ci: publish when the release PR is merged #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mschmicking merged 2 commits into from
Jul 31, 2026
Merged

ci: publish when the release PR is merged #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d55c72b
ci(release): publish when the release PR is merged
mschmicking Jul 31, 2026
7d23721
ci: add the release scope the pipeline obviously needs
mschmicking Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/pr-title.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ jobs:
cli
deps
docs
release
main
requireScope: false
# Only the trailing full stop is rejected. A lower-case rule was tried and
Expand Down
27 changes: 16 additions & 11 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,15 @@
name: Release to npm

# Manual only. There is no push/tag trigger on purpose: publishing is
# irreversible (npm forbids re-using a version number, and unpublishing is
# restricted), so it should never happen as a side effect of a commit.
# Fires when release-please publishes a GitHub Release — that only happens when a
# release pull request is merged, which is itself a deliberate act with the version
# and changelog visible for review. So merging the release PR is the single action
# that ships a version.
#
# Still dispatchable by hand, defaulting to a dry run, for re-publishing after a
# failure or validating the tarball without shipping.
on:
release:
types: [published]
workflow_dispatch:
inputs:
dry_run:
Expand Down Expand Up @@ -63,7 +69,7 @@ jobs:
fi

- name: Pack (dry run)
if: inputs.dry_run
if: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
run: npm publish --dry-run

# No NODE_AUTH_TOKEN. Publishing uses npm trusted publishing (OIDC): npm
Expand All @@ -74,13 +80,12 @@ jobs:
#
# Provenance is automatic under OIDC for a public package from a public repo,
# so --provenance is not passed explicitly.
# On a release event inputs.dry_run is undefined, so this must not rely on
# negating it — an undefined input would otherwise read as "not a dry run"
# by luck rather than intent.
- name: Publish
if: ${{ !inputs.dry_run }}
if: ${{ github.event_name == 'release' || !inputs.dry_run }}
run: npm publish --access public

- name: Tag the released commit
if: ${{ !inputs.dry_run }}
run: |
VERSION=$(node -p "require('./package.json').version")
git tag "v$VERSION"
git push origin "v$VERSION"
# No tagging step: release-please already created the tag and the GitHub
# Release that triggered this run.