| author |  Julius Marminge <julius0216@outlook.com> 2026-03-01 18:18:13-08:00 |
| committer |  Julius Marminge <jmarminge@gmail.com> 2026-03-01 18:18:47-08:00 |
| log | dca85c402c0bd9ac5e3abdca5e2542f568672393 |
| tree | cce27584af8fba5715b46a2927f3f4a416b685cc |
| parent | 56a3ad0f8b62381209be4db0ed7511142509f373 |
prep npm
2 files changed, 62 insertions(+), 0 deletions(-)
.github
workflows
docs
.github/workflows/release.yml+42
| ... | @@ -7,6 +7,7 @@ on: | ... | @@ -7,6 +7,7 @@ on: |
| 7 | 7 | ||
| 8 | permissions: | 8 | permissions: |
| 9 | contents: write | 9 | contents: write |
| 10 | id-token: write | ||
| 10 | 11 | ||
| 11 | jobs: | 12 | jobs: |
| 12 | preflight: | 13 | preflight: |
| ... | @@ -158,9 +159,50 @@ jobs: | ... | @@ -158,9 +159,50 @@ jobs: |
| 158 | path: release/* | 159 | path: release/* |
| 159 | if-no-files-found: error | 160 | if-no-files-found: error |
| 160 | 161 | ||
| 162 | # publish_cli: | ||
| 163 | # name: Publish CLI to npm | ||
| 164 | # needs: [preflight, build] | ||
| 165 | # runs-on: ubuntu-24.04 | ||
| 166 | # steps: | ||
| 167 | # - name: Checkout | ||
| 168 | # uses: actions/checkout@v4 | ||
| 169 | |||
| 170 | # - name: Setup Bun | ||
| 171 | # uses: oven-sh/setup-bun@v2 | ||
| 172 | # with: | ||
| 173 | # bun-version-file: package.json | ||
| 174 | |||
| 175 | # - name: Setup Node | ||
| 176 | # uses: actions/setup-node@v4 | ||
| 177 | # with: | ||
| 178 | # node-version-file: package.json | ||
| 179 | # registry-url: https://registry.npmjs.org | ||
| 180 | |||
| 181 | # - name: Install dependencies | ||
| 182 | # run: bun install --frozen-lockfile | ||
| 183 | |||
| 184 | # - name: Set CLI package version from release tag | ||
| 185 | # env: | ||
| 186 | # RELEASE_VERSION: ${{ needs.preflight.outputs.version }} | ||
| 187 | # run: | | ||
| 188 | # node --input-type=module -e ' | ||
| 189 | # import { readFileSync, writeFileSync } from "node:fs"; | ||
| 190 | # const packagePath = "apps/server/package.json"; | ||
| 191 | # const packageJson = JSON.parse(readFileSync(packagePath, "utf8")); | ||
| 192 | # packageJson.version = process.env.RELEASE_VERSION; | ||
| 193 | # writeFileSync(packagePath, `${JSON.stringify(packageJson, null, 2)}\n`); | ||
| 194 | # ' | ||
| 195 | |||
| 196 | # - name: Build CLI package | ||
| 197 | # run: bun run build --filter=@t3tools/web --filter=t3 | ||
| 198 | |||
| 199 | # - name: Publish CLI package | ||
| 200 | # run: bun --cwd apps/server publish --access public | ||
| 201 | |||
| 161 | release: | 202 | release: |
| 162 | name: Publish GitHub Release | 203 | name: Publish GitHub Release |
| 163 | needs: [preflight, build] | 204 | needs: [preflight, build] |
| 205 | # needs: [preflight, build, publish_cli] | ||
| 164 | runs-on: ubuntu-24.04 | 206 | runs-on: ubuntu-24.04 |
| 165 | steps: | 207 | steps: |
| 166 | - name: Download all desktop artifacts | 208 | - name: Download all desktop artifacts |
docs/release.md+20
| ... | @@ -12,8 +12,28 @@ This document covers how to run desktop releases from one tag, first without sig | ... | @@ -12,8 +12,28 @@ This document covers how to run desktop releases from one tag, first without sig |
| 12 | - Linux `x64` AppImage | 12 | - Linux `x64` AppImage |
| 13 | - Windows `x64` NSIS installer | 13 | - Windows `x64` NSIS installer |
| 14 | - Publishes one GitHub Release with all produced files. | 14 | - Publishes one GitHub Release with all produced files. |
| 15 | - Publishes the CLI package (`apps/server`, npm package `t3`) with OIDC trusted publishing. | ||
| 15 | - Signing is optional and auto-detected per platform from secrets. | 16 | - Signing is optional and auto-detected per platform from secrets. |
| 16 | 17 | ||
| 18 | ## 0) npm OIDC trusted publishing setup (CLI) | ||
| 19 | |||
| 20 | The workflow publishes the CLI with `bun publish` from `apps/server` after bumping | ||
| 21 | the package version to the release tag version. | ||
| 22 | |||
| 23 | Checklist: | ||
| 24 | |||
| 25 | 1. Confirm npm org/user owns package `t3` (or rename package first if needed). | ||
| 26 | 2. In npm package settings, configure Trusted Publisher: | ||
| 27 | - Provider: GitHub Actions | ||
| 28 | - Repository: this repo | ||
| 29 | - Workflow file: `.github/workflows/release.yml` | ||
| 30 | - Environment (if used): match your npm trusted publishing config | ||
| 31 | 3. Ensure npm account and org policies allow trusted publishing for the package. | ||
| 32 | 4. Create release tag `vX.Y.Z` and push; workflow will: | ||
| 33 | - set `apps/server/package.json` version to `X.Y.Z` | ||
| 34 | - build web + server | ||
| 35 | - run `bun publish --access public` | ||
| 36 | |||
| 17 | ## 1) Dry-run release without signing | 37 | ## 1) Dry-run release without signing |
| 18 | 38 | ||
| 19 | Use this first to validate the release pipeline. | 39 | Use this first to validate the release pipeline. |