fix: stop publishing tests and tooling config in the packages - #123
Merged
Conversation
With no `files` field, npm published everything the split repo carries: the whole tests/ tree (60-odd files, some of them 50 kB), eslint.config.js, stryker.config.json, tsconfig.json, vitest.config.ts and .gitattributes. Consumers were downloading the test suite along with the library. Restricting to dist, src and CHANGELOG.md leaves exactly what belongs there — npm always adds README, LICENSE and package.json on its own. Every path in `exports` still resolves.
The export-ignore list already covered phpstan, php-cs-fixer, phpunit and tests, but missed infection.json5, scripts/ and composer.lock — none of which mean anything to someone requiring this package. A library's lock file in particular is dead weight: Composer ignores it for dependencies.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This was referenced Aug 27, 2026
felipesauer
pushed a commit
that referenced
this pull request
Aug 27, 2026
🤖 I have created a release *beep* *boop* --- ## [0.2.2](php-v0.2.1...php-v0.2.2) (2026-08-27) ### Bug Fixes * stop publishing tests and tooling config in the packages ([#123](#123)) ([b5a0313](b5a0313)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
felipesauer
pushed a commit
to felipesauer/safeaccess-inline-php
that referenced
this pull request
Aug 27, 2026
🤖 I have created a release *beep* *boop* --- ## [0.2.2](felipesauer/safeaccess-inline@php-v0.2.1...php-v0.2.2) (2026-08-27) ### Bug Fixes * stop publishing tests and tooling config in the packages ([#123](felipesauer/safeaccess-inline#123)) ([b5a0313](felipesauer/safeaccess-inline@b5a0313)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
felipesauer
pushed a commit
that referenced
this pull request
Aug 27, 2026
🤖 I have created a release *beep* *boop* --- ## [0.2.2](js-v0.2.1...js-v0.2.2) (2026-08-27) ### Bug Fixes * stop publishing tests and tooling config in the packages ([#123](#123)) ([b5a0313](b5a0313)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
felipesauer
pushed a commit
to felipesauer/safeaccess-inline-js
that referenced
this pull request
Aug 27, 2026
🤖 I have created a release *beep* *boop* --- ## [0.2.2](felipesauer/safeaccess-inline@js-v0.2.1...js-v0.2.2) (2026-08-27) ### Bug Fixes * stop publishing tests and tooling config in the packages ([#123](felipesauer/safeaccess-inline#123)) ([b5a0313](felipesauer/safeaccess-inline@b5a0313)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two packaging defects, and the release that carries them also delivers the
documentation fixes from #119 — which are sitting on
mainbut have notreached npm or Packagist, because every commit since the last release was
chore/ci/docs/styleand none of those trigger release-please.npm was shipping the test suite
packages/js/package.jsonhad nofilesfield, so the tarball carriedeverything the split repo has:
Now restricted to
dist,srcandCHANGELOG.md— npm adds README, LICENSEand package.json on its own. Verified every path in
exportsstill resolves.The Composer archive carried tooling too
export-ignorealready covered phpstan, php-cs-fixer, phpunit and tests, butmissed
infection.json5,scripts/andcomposer.lock. A library's lock fileis dead weight — Composer ignores it for dependencies. The archive is now:
What the resulting release delivers
Beyond the two fixes above, cutting 0.2.2 finally publishes the corrected
LICENSElink in the package READMEs and the PHPStan badge from #119.