ci: Add GH workflow for publishing to npm. #43
Conversation
WalkthroughThis pull request introduces a new GitHub Actions workflow file Changes
Sequence DiagramsequenceDiagram
participant Release as Release Event
participant Workflow as GitHub Actions
participant Build as Build Job
participant Publish as Publish NPM Job
participant Branch as Create Branch Job
Release->>Workflow: Trigger workflow
Workflow->>Build: Execute build steps
Build-->>Publish: Upload artifacts
Publish->>Publish: Publish to NPM
Publish-->>Branch: Trigger branch creation
Branch->>Branch: Create and push new branch
Possibly Related PRs
Suggested Reviewers
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
junhaoliao
force-pushed
the
publish-npm
branch
from
95c6ed1 to
4b7a2be
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (4)
package.json (1)
16-16: Consider enhancing the release script with additional safeguardsThe current release script could benefit from additional checks to ensure reliable publishing:
- "release": "git diff --exit-code && task package && npm publish" + "release": "npm version check && git diff --exit-code HEAD && task package && npm pack --dry-run && npm publish"This modification:
- Validates the package version
- Ensures clean working directory (comparing with HEAD)
- Performs a dry-run package check before publishing
.github/workflows/publish-npm.yml (3)
18-22: Implement caching for task dependenciesAdd caching for the task CLI to improve workflow performance.
+ - uses: actions/cache@v3 + with: + path: ~/.npm + key: ${{ runner.os }}-task-${{ hashFiles('**/package-lock.json') }} + restore-keys: | + ${{ runner.os }}-task- + - name: "Install task" run: "npm install -g @go-task/cli"
61-64: Add error handling for branch creationThe branch creation step should handle potential failures gracefully.
- name: "Create and push branch" run: | + if git show-ref --quiet refs/heads/"${{github.ref_name}}"; then + echo "Branch already exists, skipping creation" + exit 0 + fi git checkout -b "${{github.ref_name}}" git push origin "refs/heads/${{github.ref_name}}"
3-6: Consider adding version tag filteringThe workflow triggers on all releases. Consider filtering for specific version patterns.
on: release: types: ["created"] + tags: + - 'v[0-9]+.[0-9]+.[0-9]+'
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/publish-npm.yml(1 hunks)package.json(1 hunks)
🧰 Additional context used
🪛 GitHub Check: lint (macos-latest)
.github/workflows/publish-npm.yml
[failure] 50-50:
50:17 [quoted-strings] string value is not quoted with double quotes
🔇 Additional comments (1)
.github/workflows/publish-npm.yml (1)
8-8: Define explicit permissions for workflow jobs
The root-level permissions block is empty. Consider defining explicit permissions to follow the principle of least privilege.
[security]
-permissions: {}
+permissions:
+ contents: read
+ packages: read| - uses: "actions/setup-node@v4" | ||
| with: | ||
| node-version: 22 | ||
| registry-url: "https://registry.npmjs.org/" |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Consider using LTS version of Node.js
Node.js 22 is currently in development. For production publishing workflows, it's recommended to use an LTS version.
with:
- node-version: 22
+ node-version: 20
registry-url: "https://registry.npmjs.org/"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: "actions/setup-node@v4" | |
| with: | |
| node-version: 22 | |
| registry-url: "https://registry.npmjs.org/" | |
| - uses: "actions/setup-node@v4" | |
| with: | |
| node-version: 20 | |
| registry-url: "https://registry.npmjs.org/" |
| - run: "npm publish" | ||
| env: | ||
| NODE_AUTH_TOKEN: "${{secrets.NPM_TOKEN}}" |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add package validation steps before publishing
Consider adding validation steps before publishing to ensure package integrity.
+ - name: "Validate package"
+ run: |
+ npm pack --dry-run
+ npm audit
+
- run: "npm publish"
env:
NODE_AUTH_TOKEN: "${{secrets.NPM_TOKEN}}"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - run: "npm publish" | |
| env: | |
| NODE_AUTH_TOKEN: "${{secrets.NPM_TOKEN}}" | |
| - name: "Validate package" | |
| run: | | |
| npm pack --dry-run | |
| npm audit | |
| - run: "npm publish" | |
| env: | |
| NODE_AUTH_TOKEN: "${{secrets.NPM_TOKEN}}" |
junhaoliao
changed the title
junhaoliao
changed the title
Description
Changes made
Related: #44
package.jsonscriptreleasewhich is used for manual releases.secrets.NPM_TOKENinto y-scope/clp-ffi-js. @kirkrodrigues steps documented at# Validation performed -> 2..Making a release
With this automation workflow added, here's a proposed flow for making a release:
npm version <major | minor | patch> -m "chore: Upgrade version for %s release."vA.B.C; then click “Create new tag:vA.B.Con publish”.npm install clp-ffi-js) in a project. If good, edit the GitHub pre-release and “Update release”.Validation performed
npm run releaseand observednpm packagewas run although the publish failed because the npm registry does not support overwriting an already published version:Token name:GITHUB_CLP_FFI_JS_NPM_TOKEN.Packages and scopes->Permissions->Read and write->Only select packages and scopes->Select packages and scopes->clp-ffi-js.NPM_TOKENwith the generated npm token at https://github.com/junhaoliao/clp-ffi-js/settings/secrets/actions/newnpm publishcommand was run although the publish failed because versionv0.3.1already exists.npm publishjob), a branch was created with name as the version number.Summary by CodeRabbit