ci(release): release-please + provenance npm publishing - #13
Merged
Conversation
Replicate the release pipeline from the @speechify/api TypeScript SDK, adapted for this tsup CLI (no Fern-generated version literals). - release-please.yml: compile + test on push/PR, release-please on push to main, then publish with npm provenance (OIDC trusted publishing, no token). alpha/beta tags publish to matching dist-tags. - manual-publish.yml: workflow_dispatch fallback (and the first release). - Publish asserts every version-bearing property agrees with the release tag: package.json, the built `dist/bin.js --version`, and the repository.url casing (npm provenance rejects a case-inexact URL with 422). - release-please-config.json: release-type node, pre-1.0 semantics enabled — bump-minor-pre-major + bump-patch-for-minor-pre-major, so breaking changes bump minor and features bump patch while on 0.x (nothing jumps to 1.0.0). - Pin packageManager to pnpm@10.33.4 for corepack. Requires a one-time npm trusted-publisher config for @speechify/cli (GitHub Actions, repo Speechify-AI/cli). First publish goes via manual-publish.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sets up npm publishing CI/CD, replicating the pipeline from the
@speechify/apiTypeScript SDK (Speechify-AI/sdk-typescript), adapted for this tsup-built CLI.Workflows
release-please.yml—compile+teston every push/PR; on push tomain,release-pleaseopens/updates a release PR; when a release is cut,publishbuilds and publishes to npm with provenance via OIDC trusted publishing (no NPM token).alpha/betatags publish to matching dist-tags. (This PR itself runs the compile + test jobs.)manual-publish.yml—workflow_dispatchfallback for a tagged release whose auto-publish didn't run, and the way to cut the first release.Guardrails (same philosophy as the SDK)
Before anything reaches npm, the publish job asserts every version-bearing property agrees with the release tag:
package.jsonversionnode dist/bin.js --versionrepository.urlcasing (npm provenance rejects a case-inexact URL with HTTP 422)Adaptations vs. the SDK
.fern/metadata.json/dist/cjs|esmassertions — the CLI isn't Fern-generated. tsup bakes the version intodist/bin.js(__CLI_VERSION__) frompackage.json, sopackage.jsonis the single source of truth; nothing needs stamping.pnpm typecheck(tsup emits without type-checking, whereas the SDK'stscbuild type-checks for free).Versioning (v0)
release-please-config.jsonenables pre-1.0 semantics:bump-minor-pre-major→ breaking changes bump minor (0.1.0 → 0.2.0)bump-patch-for-minor-pre-major→ features bump patch (0.1.0 → 0.1.1)Nothing reaches 1.0.0 until intended.
Configure a Trusted Publisher for
@speechify/clion npmjs.org → orgSpeechify-AI, repocli, workflowsrelease-please.ymlandmanual-publish.yml. The package is currently unpublished, so the first release should go via manual-publish (ref+expected_version) once the trusted publisher is set.Validated locally: JSON/YAML parse,
pnpm install --frozen-lockfile(lockfile carries Linux keyring binaries), typecheck, build, 210 tests, and the assertion scripts (pass at true tag; refuse wrong tag and wrong repo-casing).