Repository navigation
ci: npm publish pipeline for @corbits workflows and tools (CL-8167) - #763
Merged
Merged
Conversation
TheGreatAxios
force-pushed
the
cl-8167-publish-pipeline
branch
from
September 17, 2026 17:53
928ea79 to
d169b40
Compare
CL-8167 adds a check verifying .changeset/config.json's ignore list stays in sync with the workspace's publishable packages; extend the roster test that pins check:structural's discovered set so it expects the new check by name. Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
…-8167) Wires @changesets/cli into the packages CL-8157 made publishable: - .changeset/config.json (public access, main as the base branch) with an `ignore` list computed from every workspace package's `private` flag, plus any package that transitively depends on one of those (@corbits/code-review-workflow depends on the still-private @corbits/code-review, so it stays out of the publish set until one of the two changes). - scripts/gen-changeset-config.ts regenerates that list; the new changeset-ignore structural check fails when it drifts. - scripts/release.ts packs and publishes every publishable package whose version moved past what's on npm, skipping ones already published; `--dry-run` packs and `npm publish --dry-run`s everything without a token, for local and CI use. It never reads a credential from a file — the token comes from the environment. - .github/workflows/publish.yml: `publish-dry-run` runs the dry-run on every pull request; on push to main, changesets/action opens or updates the version PR, and once its changesets are gone it runs the real, provenance-signed release. - A "first publishable release" changeset bumps every currently publishable package as a minor, so the version PR has something to release once this lands. - tool-package-freshness's error message now points at `bun run changeset` instead of a hand-bumped version, since changesets is now how that bump gets made. NPM_TOKEN must be added to the repository's secrets before the first release can run. Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
Documents the CL-8167 flow in CONTRIBUTING.md: run `bun run changeset` and commit the generated file alongside a tool or workflow change, instead of hand-bumping its version; the automated version PR does the bump and changelog. Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
.changeset/config.json's ignore list was hand-stale after rebasing onto origin/main: @workbench/templates no longer exists (deleted templates/), and @corbits/preferences / @corbits/run-key-history dropped their dead hub mounts, so scripts/gen-changeset-config.ts recomputes the ignore list from disk instead of carrying the old snapshot. bun.lock refreshed via bun install against origin/main's lock.
Main's tool-package flips (access-tools, interaction-tools, connections-tools, error-sink, code-review now public) move them off the changesets ignore list; the first-publishable-release changeset is updated to cover every non-private workspace package.
TheGreatAxios
force-pushed
the
cl-8167-publish-pipeline
branch
from
September 17, 2026 17:58
d169b40 to
687ce1a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the changesets-driven npm publish pipeline for every
workflows/*and
packages/*-toolspackage CL-8157 (#760) made publishable:.changeset/config.json—access: public,baseBranch: main, and anignorelist computed (never hand-typed) from every workspacepackage's
privateflag, extended to any package that transitivelydepends on a still-private one. That extension caught a real gap:
@corbits/code-review-workflowis public but depends on the still-private@corbits/code-review, which would make its published tarballuninstallable — it's excluded until one side of that changes.
scripts/gen-changeset-config.tsregenerates the list; the newchangeset-ignorestructural check fails on drift.scripts/release.ts— packs and publishes every publishable packagewhose version is ahead of what's on npm, skipping already-published
versions.
--dry-runruns the same pack +npm publish --dry-runwithout touching the registry or needing a token. Never reads a
credential from a file.
.github/workflows/publish.yml—publish-dry-runruns on every pullrequest (no secrets needed). On push to main,
changesets/actionopens/updates the "Version Packages" PR while changesets are pending;
once that PR merges, the same job runs the real, provenance-signed
release with
NPM_TOKENandid-token: write..changeset/first-publishable-release.mdchangeset bumps everycurrently publishable package as a minor, so the version PR has
something to do.
CONTRIBUTING.mdand thetool-package-freshnesscheck's message nowpoint at
bun run changesetinstead of a hand-bumped version.Owner action required
NPM_TOKENmust be added to the repo's GitHub Actions secretsbefore the first release job can publish (an npm automation/granular
token with publish rights to the
@corbitsorg).@corbitsnpm org exists and this token can publish to it— the pipeline assumes both.
Verification
bun run typecheck— passes except two pre-existing failures inpackages/chat-ui/test/*unrelated to this change (present beforethis branch touched anything, confirmed via
git logon those files).bun run lint— passes except one pre-existing formatting warning inscripts/checks/publishable-workflows.ts, untouched by this PR.bun run check:structural— all checks green, including the newchangeset-ignorecheck.bun run release -- --dry-run— packed and dry-run published all 27currently publishable packages cleanly.
bun x @changesets/cli status— reports the pending minor bump forall 27 packages, no config errors.
Test plan
NPM_TOKENsecretwith provenance
https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG