Repository navigation
Prepare the package for publishing to npm - #1
Merged
Merged
Conversation
**Summary**
- Relative imports in `src` now end in `.js` (and `./fallback.css.js` for the fallback stylesheet module), so the built package loads under plain Node ESM and `moduleResolution: nodenext`.
**Why**
- The published `dist` had extensionless imports such as `./types`, which bundlers resolve but Node refuses (`ERR_MODULE_NOT_FOUND`). A smoke install of the packed tarball showed `import('@liminal-hq/jax')` failing outside a bundler.
**Details**
- A mechanical change across 18 files; `tsc` with `moduleResolution: bundler` accepts `.js` for `.ts` sources, so nothing else changes.
- `src/imports.test.ts` fails if a relative import ever loses its extension.
**Validation**
- `bun run test`, `bun run lint`, `bun run format:check` and `bun run build` pass; the packed tarball imports and type-checks under Node ESM and `nodenext`.
**Summary** - The tarball now includes `LICENSE-APACHE` and `LICENSE-MIT`, and `scripts/check-package.mjs` fails when a required file is missing or source, demo or asset files would be published. **Why** - npm only adds a file named exactly `LICENSE` on its own, so both licences were missing from the package. **Details** - `package.json`: `files` lists the licences, `description` matches the GitHub description, more `keywords`, and a `check:package` script. - `bun.lock` is regenerated in lockfile format 1 (bun 1.3), the same format `undertone` uses, so CI's `--frozen-lockfile` install accepts it. - Version stays `0.0.0`; the release bump goes on its own `chore/release-v<version>` branch. **Validation** - `npm pack --dry-run` lists both licences and `README.md`; `bun install --frozen-lockfile` passes.
…dabot config **Summary** - `ci.yml` builds, tests, lints, checks formatting and the package contents, and builds the demo on pull requests and pushes to `main`. - `release.yml` follows `undertone`: a `v*` tag or a manual run verifies the tag against `package.json`, packs and checks the tarball, attaches it to a GitHub release and publishes to npm with provenance after approval on the `npm-publish` environment. **Details** - A manual run with `release_draft` set to true skips the npm step, so the pipeline can be exercised without publishing. - `.github/release.yml` sorts release notes by label, excluding `skip-changelog` and `internal`. - `.github/dependabot.yml` is set up for `npm` and `github-actions` but switched off with `open-pull-requests-limit: 0`; raise the limits to turn it on. **Notes** - The `npm-publish` environment and the organisation `NPM_TOKEN` secret are repository settings, not part of this change.
**Summary** - `AGENTS.md` describes releasing (bump on `chore/release-v<version>`, tag or run the workflow, approve `npm-publish`) and the dormant Dependabot config; `README.md` gets an npm version badge and the `three` versions tested (0.160 and 0.186).
ScottMorris
added
build
… the input out of the shell
**Summary**
- The release workflow now compares the tag with the version in `package.json` before it creates a GitHub release, for tag pushes and manual runs alike.
- The manual `release_tag` input reaches the script through `env` instead of being interpolated into it.
**Why**
- The version check only ran for tag pushes, so a manual run with `release_tag: v9.9.9` could attach and publish the `0.0.0` package under the wrong release.
- Interpolating `${{ inputs.release_tag }}` into the script let a crafted value run commands in a job holding `contents: write`.
**Details**
- The tag must also match `^v[0-9A-Za-z._-]+$` before use, and the check moved into the "Resolve release tag" step so nothing is created when it fails.
- The old push-only check in the verify job is removed because the earlier step covers it.
**Validation**
- Ran the step's script for a matching tag push, a mismatched push, a manual run with no tag, a mismatched manual tag, a quote-injection value and a non-`v` tag: only the two matching cases succeed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
LICENSE-APACHEandLICENSE-MIT, andscripts/check-package.mjs(run in CI and in the release) fails when a required file is missing or source, demo or asset files would be published.srcnow names its.jsfile. The built package previously failed to load under plain Node ESM (ERR_MODULE_NOT_FOUNDon./types), which a smoke install of the packed tarball exposed.src/imports.test.tsguards it.undertone: CI builds, tests, lints, checks formatting and the package, and builds the demo. The release workflow verifies the tag againstpackage.json, packs and checks the tarball, attaches it to a GitHub release and publishes with provenance after approval on thenpm-publishenvironment. A manual run withrelease_draftskips the npm step..github/release.ymlsorts notes by label..github/dependabot.ymlis set up fornpmandgithub-actionsbut switched off (open-pull-requests-limit: 0), likejar.bun.lockis in lockfile format 1 (bun 1.3, asundertoneuses).AGENTS.mddocuments releasing, andREADME.mdgets an npm badge and the testedthreeversions.Maintainer-facing changes
npm-publishenvironment with a required reviewer, the same asundertone. The organisationNPM_TOKENsecret is visible to all repositories, so no change was needed.0.0.0. The first release follows thechore/release-v<version>flow inAGENTS.md.Known limitations
npm-publishapproval and the realnpm publishhave not been exercised. The look and smoothness of the moods have only been checked in software-rendered screenshots, not on a real GPU.undertone's; npm resolves it from therepositoryfield.Test plan
bun install --frozen-lockfilebun run test(163 tests; also tested againstthree0.186.1 in a scratch copy)bun run lintandbun run format:checkbun run buildandbunx vite build demonode scripts/check-package.mjs;npm pack --dry-runlists both licences and the readmethree: both entry points import under Node ESM, and the types resolve undernodenextrelease_draftset to true