docs(release): restore alpha publishing and docs deployment [Codex] - #355
docs(release): restore alpha publishing and docs deployment [Codex]#355jderochervlk wants to merge 2 commits into
Conversation
|
@jderochervlk Can we actually decouple the release and publish steps from the |
Sure, that makes sense. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2535ba61d0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| on: | ||
| pull_request: | ||
| branches: | ||
| - main | ||
| workflow_dispatch: |
There was a problem hiding this comment.
Trigger alpha publishing after main pushes
This workflow is triggered only for pull requests and manual dispatches. Since the same change removes the publishing steps from the main-push CI workflow, merging to main no longer publishes the commit-specific alpha release; releases occur only when someone manually dispatches this workflow, contrary to the restored main-branch release flow.
Useful? React with 👍 / 👎.
| run: npm publish ./rescript-webapi-*.tgz --access public --tag alpha --dry-run | ||
|
|
||
| - name: Publish npm package | ||
| if: github.event_name == 'workflow_dispatch' && !inputs.dry_run |
There was a problem hiding this comment.
Restrict manual publishing to the main branch
When a caller dispatches this workflow with dry_run=false, they can select a feature-branch or tag ref, and checkout will package that selected ref. Because this condition checks only the event and input, such a run publishes that non-main code under the shared alpha tag; add an explicit main-ref restriction if releases are intended to remain main-branch-only.
Useful? React with 👍 / 👎.
| publish: | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
Gate real publishes on successful validation
This standalone publish job installs dependencies and immediately packages the selected commit without running the repository's formatting, build, feature, test, or documentation checks, and it has no dependency on the CI workflow. A manual run with dry_run=false can therefore publish an alpha while CI is still running or after it has failed; run the validation steps here or trigger publishing only from a successful CI run.
Useful? React with 👍 / 👎.
| - name: Setup Node.js | ||
| uses: actions/setup-node@v7 | ||
| with: | ||
| node-version: "24" |
There was a problem hiding this comment.
Install an npm version that supports trusted publishing
node-version: "24" constrains Node.js but does not guarantee a compatible npm CLI. This workflow removes NODE_AUTH_TOKEN and relies entirely on npm trusted publishing, which requires npm 11.5.1 or later; with an older bundled npm, such as npm 11.4.2 in the inspected Node 24.15.0 toolchain, npm publish does not exchange the OIDC token and exits with ENEEDAUTH. Explicitly install or pin a supported npm version before publishing.
Useful? React with 👍 / 👎.
Context
The CI workflow combined validation, packaging, and npm publishing, so every push to
maincreated an alpha release. That made releases harder to control and kept publishing concerns coupled to the normal build.Changes
mainwithnpm publish --dry-rundry_run: true; publishing requires explicitly setting it tofalsealphadist-tag through npm trusted publishingalphachannel