Configure npm publishing for JavaScript SDK - #3
Merged
Conversation
- Fix TypeScript build output path (dist/ instead of dist/src/)
- Add root package.json with npm workspaces support
- Add publishConfig with provenance for supply chain security
- Remove auto-publish workflow, keep tag-based releases only
- Add .npmignore to exclude source files from package
- Update GitHub Actions workflow with provenance support
Release process: Create GitHub release with tag format js-sdk-v{version}
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
nicolasiscoding
pushed a commit
that referenced
this pull request
Jul 29, 2026
…ns (#50) Resolves all 6 open high-severity Dependabot alerts in this repo: | Package | Alerts | Was | Now | Advisory | |-----------------|----------|---------|---------|---------------------| | brace-expansion | #17, #35 | 1.1.12 | 1.1.16 | GHSA-3jxr-9vmj-r5cp | | js-yaml | #18, #36 | 3.14.2 | 3.15.0 | GHSA-52cp-r559-cp3m | | minimatch | #3, #21 | 3.1.2 | 3.1.5 | GHSA-7r86-cg39-jmmj | Each alert is filed twice, once per lockfile (root and packages/js-sdk), so both lockfiles are updated. All three are dev-only transitive dependencies of the Jest/ts-jest test toolchain — none is a direct dependency, none appears in any package.json, and the JS SDK has zero runtime dependencies, so nothing here ships to consumers. No manifest change was needed: every patched version already satisfies the existing semver range its consumers declare (minimatch ^3.1.1, brace-expansion ^1.1.x, js-yaml ^3.13.x), so a plain `npm update` resolves them. No `overrides` pin is used, which keeps future patch releases flowing normally. Verified: `npm ci`, `npm run build:js` (tsc), and `npm run test:js` (271/271 tests) all pass. Co-authored-by: yacineKahlerras <kahlerasse@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Configures npm publishing setup for the JavaScript SDK with tag-based automated releases.
Changes
✅ Fixed critical build issues:
rootDirfrom"."to"./src"- fixes build output path fromdist/src/todist/✅ Added npm workspace support:
package.jsonwith workspaces configurationnpm cifailures in GitHub Actions✅ Enhanced publishing configuration:
publishConfigwithprovenance: truefor supply chain security.npmignoreto exclude source files from published packageLICENSEto published files✅ Streamlined GitHub workflows:
release-js.yml) that ran on every main pushRelease Process
After merging:
js-sdk-v0.1.0Tag Strategy
js-sdk-v{version}(e.g.,js-sdk-v0.1.0)py-sdk-v{version}go-sdk-v{version}The tag prefix ensures only the intended SDK workflow runs.
Verification
All tests pass ✅
dist/(notdist/src/)dist/,README.md,LICENSE,package.json🤖 Generated with Claude Code