| author |  Julius Marminge <julius0216@outlook.com> 2026-03-01 18:18:13-08:00 |
| committer |  Julius Marminge <jmarminge@gmail.com> 2026-03-01 18:18:47-08:00 |
| log | dca85c402c0bd9ac5e3abdca5e2542f568672393 |
| tree | cce27584af8fba5715b46a2927f3f4a416b685cc |
| parent | 56a3ad0f8b62381209be4db0ed7511142509f373 |
prep npm
2 files changed, 62 insertions(+), 0 deletions(-)
.github
workflows
docs
.github/workflows/release.yml+42
| ... | ... | @@ -7,6 +7,7 @@ on: |
| 7 | 7 | |
| 8 | 8 | permissions: |
| 9 | 9 | contents: write |
| 10 | id-token: write | |
| 10 | 11 | |
| 11 | 12 | jobs: |
| 12 | 13 | preflight: |
| ... | ... | @@ -158,9 +159,50 @@ jobs: |
| 158 | 159 | path: release/* |
| 159 | 160 | if-no-files-found: error |
| 160 | 161 | |
| 162 | # publish_cli: | |
| 163 | # name: Publish CLI to npm | |
| 164 | # needs: [preflight, build] | |
| 165 | # runs-on: ubuntu-24.04 | |
| 166 | # steps: | |
| 167 | # - name: Checkout | |
| 168 | # uses: actions/checkout@v4 | |
| 169 | ||
| 170 | # - name: Setup Bun | |
| 171 | # uses: oven-sh/setup-bun@v2 | |
| 172 | # with: | |
| 173 | # bun-version-file: package.json | |
| 174 | ||
| 175 | # - name: Setup Node | |
| 176 | # uses: actions/setup-node@v4 | |
| 177 | # with: | |
| 178 | # node-version-file: package.json | |
| 179 | # registry-url: https://registry.npmjs.org | |
| 180 | ||
| 181 | # - name: Install dependencies | |
| 182 | # run: bun install --frozen-lockfile | |
| 183 | ||
| 184 | # - name: Set CLI package version from release tag | |
| 185 | # env: | |
| 186 | # RELEASE_VERSION: ${{ needs.preflight.outputs.version }} | |
| 187 | # run: | | |
| 188 | # node --input-type=module -e ' | |
| 189 | # import { readFileSync, writeFileSync } from "node:fs"; | |
| 190 | # const packagePath = "apps/server/package.json"; | |
| 191 | # const packageJson = JSON.parse(readFileSync(packagePath, "utf8")); | |
| 192 | # packageJson.version = process.env.RELEASE_VERSION; | |
| 193 | # writeFileSync(packagePath, `${JSON.stringify(packageJson, null, 2)}\n`); | |
| 194 | # ' | |
| 195 | ||
| 196 | # - name: Build CLI package | |
| 197 | # run: bun run build --filter=@t3tools/web --filter=t3 | |
| 198 | ||
| 199 | # - name: Publish CLI package | |
| 200 | # run: bun --cwd apps/server publish --access public | |
| 201 | ||
| 161 | 202 | release: |
| 162 | 203 | name: Publish GitHub Release |
| 163 | 204 | needs: [preflight, build] |
| 205 | # needs: [preflight, build, publish_cli] | |
| 164 | 206 | runs-on: ubuntu-24.04 |
| 165 | 207 | steps: |
| 166 | 208 | - name: Download all desktop artifacts |
docs/release.md+20
| ... | ... | @@ -12,8 +12,28 @@ This document covers how to run desktop releases from one tag, first without sig |
| 12 | 12 | - Linux `x64` AppImage |
| 13 | 13 | - Windows `x64` NSIS installer |
| 14 | 14 | - Publishes one GitHub Release with all produced files. |
| 15 | - Publishes the CLI package (`apps/server`, npm package `t3`) with OIDC trusted publishing. | |
| 15 | 16 | - Signing is optional and auto-detected per platform from secrets. |
| 16 | 17 | |
| 18 | ## 0) npm OIDC trusted publishing setup (CLI) | |
| 19 | ||
| 20 | The workflow publishes the CLI with `bun publish` from `apps/server` after bumping | |
| 21 | the package version to the release tag version. | |
| 22 | ||
| 23 | Checklist: | |
| 24 | ||
| 25 | 1. Confirm npm org/user owns package `t3` (or rename package first if needed). | |
| 26 | 2. In npm package settings, configure Trusted Publisher: | |
| 27 | - Provider: GitHub Actions | |
| 28 | - Repository: this repo | |
| 29 | - Workflow file: `.github/workflows/release.yml` | |
| 30 | - Environment (if used): match your npm trusted publishing config | |
| 31 | 3. Ensure npm account and org policies allow trusted publishing for the package. | |
| 32 | 4. Create release tag `vX.Y.Z` and push; workflow will: | |
| 33 | - set `apps/server/package.json` version to `X.Y.Z` | |
| 34 | - build web + server | |
| 35 | - run `bun publish --access public` | |
| 36 | ||
| 17 | 37 | ## 1) Dry-run release without signing |
| 18 | 38 | |
| 19 | 39 | Use this first to validate the release pipeline. |