Skip to content

releasing.md

Latest commit

 

History

History
54 lines (43 loc) · 2 KB

releasing.md

File metadata and controls

54 lines (43 loc) · 2 KB
Raw

Releasing

Publishing is driven by version tags and npm Trusted Publishing. GitHub Actions uses a short-lived OpenID Connect identity, so the repository does not need an npm token.

npm trusted publisher

The solid-objects package must authorize this GitHub Actions identity:

  • Organization or user: cardmagic
  • Repository: solid-objects-js
  • Workflow filename: ci.yml
  • Environment: none
  • Allowed action: npm publish

The relationship can be created while authenticated as a package owner:

npm trust github solid-objects \
  --repo cardmagic/solid-objects-js \
  --file ci.yml \
  --allow-publish \
  --yes

Release procedure

  1. Update the version in package.json and src/version.ts. Refresh the lockfile when necessary. Move the release notes out of the Unreleased section in CHANGELOG.md into a dated section for the new version. The publish job reads that section, so a version without one fails the release.

  2. Run pnpm run format:check, pnpm run check, pnpm run test:coverage, pnpm run build, pnpm run pack:check, pnpm run test:package, pnpm run test:recovery, pnpm run test:browser, and pnpm audit --audit-level=high. Run the PostgreSQL, MySQL, and Redis jobs against the versions in the support matrix.

  3. Commit and push main.

  4. Create and push an annotated tag matching the package version:

    git tag -a v0.13.3 -m "Version 0.13.3"
git push origin v0.13.3

The tag runs the complete CI matrix. The publish job starts only after every quality, database, Redis, and browser job succeeds. It rejects tags that do not match package.json, safely skips versions already present in npm, and publishes new versions with npm provenance.

The job then builds the release notes with scripts/release-notes.mjs. That script prints the CHANGELOG.md section for the tagged version. The job then creates the GitHub release for the tag. If you run the job again on a tag that npm already holds, it still creates a missing release.