ci: mirror every release to GitHub Packages as well as npm - #5
Merged
Conversation
Both registries now get every version. npm is canonical — it is what the consumer repos install from and the only one that needs no credential — and GitHub Packages receives a mirror of the same version immediately after. The mirror is a plain `npm publish --registry=https://npm.pkg.github.com` after semantic-release, so package.json stays pinned to npmjs and the second target is a command-line override. It authenticates with GITHUB_TOKEN, which GitHub Packages accepts for a same-repo publish, so no additional secret exists. It self-skips when nothing was released. semantic-release's npm plugin writes the real version into package.json in the workspace during prepare, so a version other than the 0.0.0-development placeholder is the signal that a release happened. A docs-only push leaves the placeholder and the step no-ops rather than failing. Worth being clear about what this does not buy: GitHub Packages still cannot be installed from without an access token, because that is a GitHub restriction on reads rather than on publishing. The mirror is for the org-internal package listing and for anything still pointed there — it is not a way to consume the package without credentials. If the two registries ever disagree, npm is right. GitHub Packages currently holds 0.2.0, 0.2.1 and 0.3.0 from before the move to npm, and has received nothing since; from 0.4.0 onward the two stay in step.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishes each release to both registries: npmjs first (canonical), then a
mirror to GitHub Packages.
npm publish --registry=https://npm.pkg.github.comafter semantic-release, sopackage.jsonstays pinned to npmjs and the second target is a CLI overrideGITHUB_TOKEN— GitHub Packages accepts it for a same-repopublish, so no new secret
replaced the
0.0.0-developmentplaceholder. A docs-only push no-ops ratherthan failing
What this does not buy
GitHub Packages still requires an access token to install, even for public
packages — that is a GitHub restriction on reads, not on publishing. So the
mirror is for the org-internal listing and for anything still pointed there; it
is not a way to consume the package without credentials. Both consumer repos
resolve from npm.
If the two registries ever disagree, npm is canonical.
Current state
GitHub Packages holds
0.2.0,0.2.1,0.3.0from before the move to npm andhas had nothing since. From
0.4.0onward the two stay in step.