ci: release without anyone running a release - #7
Merged
Conversation
Mirrors ai-forms#16 so both libraries release identically. Cutting a release meant `npm version && git push --tags` by hand. Now merging a version bump to main ships the package: the workflow asks the registry whether package.json's version already exists and publishes it if not. That check rather than a tag trigger, because a tag pushed by GITHUB_TOKEN does not start another workflow — "push a tag, let publish.yml notice" silently never runs — and because asking npm what is published is idempotent, so a re-run or a hand-pushed tag cannot double-publish. The tag is created after a successful publish, so it never claims a release that did not happen. NPM_TOKEN expires 2026-11-14. token-health.yml probes `npm whoami` weekly and opens a single issue when it fails, with the fix in it — rather than letting a release three months from now be the thing that discovers the expiry, reported as a 403 that reads like a permissions problem. Verified: both files parse, and the registry check answers correctly against the real registry for threadkit@0.1.0 (already published → skip). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mirrors ai-forms#16 so both libraries release identically.
Cutting a release
Meant
npm version && git push --tagsby hand. Now merging a version bump to main ships the package — the workflow asks the registry whetherpackage.json's version already exists and publishes it if not.That check rather than a tag trigger, because:
GITHUB_TOKENdoesn't start another workflow, so "push a tag, let publish.yml notice" silently never runsThe tag is created after a successful publish, so it never claims a release that didn't happen.
Token expiry
NPM_TOKENexpires 2026-11-14.token-health.ymlprobesnpm whoamiweekly and opens one issue when it fails, with the fix in it — rather than letting a release three months from now discover the expiry, reported as a403that reads like a permissions problem.Verified: both files parse, and the registry check answers correctly against the real registry for
threadkit@0.1.0(already published → skip).🤖 Generated with Claude Code