chore(core): public access + npm trusted publishing from CI - #6
Merged
Conversation
Scoped packages default to restricted; @angular-gsap/core is public. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Local nx release versions, tags, and creates the GitHub release with --skip-publish; the release event triggers release.yml, which builds, stamps the version from the tag (nx only versions the local dist manifest), and npm-publishes with OIDC. No stored npm token. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
luishcastroc
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
publishConfig
Adds
publishConfig.access: publictolibs/core/package.jsonso the scoped package can be published (scoped packages default to restricted, which free accounts can't publish). ng-packagr carries the field into the dist package.json.Release workflow (trusted publishing / OIDC)
New
.github/workflows/release.yml: publishing a GitHub release triggers a CI job that buildscore, stamps the version from the release tag (nx releaseonly writes the new version into the local dist manifest, so a fresh CI build would otherwise carry the stale source version), and runsnpm publishauthenticated by OIDC trusted publishing — no npm token stored in the repo, and npm attaches provenance automatically.Release flow becomes:
pnpm nx release --skip-publishlocally → version, changelog, tag, GitHub releaserelease.yml→ npm publish via OIDCCONTRIBUTING.md updated to match. Note: the first publish still has to happen locally (
pnpm nx release --first-releaseafternpm login) because npm only allows registering a trusted publisher on a package that already exists; after that, register the trusted publisher (repoangular-gsap/angular-gsap, workflowrelease.yml) in the package's npm settings and CI takes over.🤖 Generated with Claude Code