From dca85c402c0bd9ac5e3abdca5e2542f568672393 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Sun, 1 Mar 2026 18:18:13 -0800
Subject: [PATCH] prep npm

---
 .github/workflows/release.yml | 42 +++++++++++++++++++++++++++++++++++
 docs/release.md               | 20 +++++++++++++++++
 2 files changed, 62 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5008c6f6a3d525313a5e55b90da4d7988648a67..e61c7b40615369e3c53d7d28ca99429859a4340e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   preflight:
@@ -158,9 +159,50 @@ jobs:
           path: release/*
           if-no-files-found: error
 
+  # publish_cli:
+  #   name: Publish CLI to npm
+  #   needs: [preflight, build]
+  #   runs-on: ubuntu-24.04
+  #   steps:
+  #     - name: Checkout
+  #       uses: actions/checkout@v4
+
+  #     - name: Setup Bun
+  #       uses: oven-sh/setup-bun@v2
+  #       with:
+  #         bun-version-file: package.json
+
+  #     - name: Setup Node
+  #       uses: actions/setup-node@v4
+  #       with:
+  #         node-version-file: package.json
+  #         registry-url: https://registry.npmjs.org
+
+  #     - name: Install dependencies
+  #       run: bun install --frozen-lockfile
+
+  #     - name: Set CLI package version from release tag
+  #       env:
+  #         RELEASE_VERSION: ${{ needs.preflight.outputs.version }}
+  #       run: |
+  #         node --input-type=module -e '
+  #           import { readFileSync, writeFileSync } from "node:fs";
+  #           const packagePath = "apps/server/package.json";
+  #           const packageJson = JSON.parse(readFileSync(packagePath, "utf8"));
+  #           packageJson.version = process.env.RELEASE_VERSION;
+  #           writeFileSync(packagePath, `${JSON.stringify(packageJson, null, 2)}\n`);
+  #         '
+
+  #     - name: Build CLI package
+  #       run: bun run build --filter=@t3tools/web --filter=t3
+
+  #     - name: Publish CLI package
+  #       run: bun --cwd apps/server publish --access public
+
   release:
     name: Publish GitHub Release
     needs: [preflight, build]
+    # needs: [preflight, build, publish_cli]
     runs-on: ubuntu-24.04
     steps:
       - name: Download all desktop artifacts
diff --git a/docs/release.md b/docs/release.md
index d99bf8fc236b9c9b9328df2410d4f2b9cf259a10..091cce82cd7e05623143fd2eaccbd67c5c8404fa 100644
--- a/docs/release.md
+++ b/docs/release.md
@@ -12,8 +12,28 @@ This document covers how to run desktop releases from one tag, first without sig
   - Linux `x64` AppImage
   - Windows `x64` NSIS installer
 - Publishes one GitHub Release with all produced files.
+- Publishes the CLI package (`apps/server`, npm package `t3`) with OIDC trusted publishing.
 - Signing is optional and auto-detected per platform from secrets.
 
+## 0) npm OIDC trusted publishing setup (CLI)
+
+The workflow publishes the CLI with `bun publish` from `apps/server` after bumping
+the package version to the release tag version.
+
+Checklist:
+
+1. Confirm npm org/user owns package `t3` (or rename package first if needed).
+2. In npm package settings, configure Trusted Publisher:
+   - Provider: GitHub Actions
+   - Repository: this repo
+   - Workflow file: `.github/workflows/release.yml`
+   - Environment (if used): match your npm trusted publishing config
+3. Ensure npm account and org policies allow trusted publishing for the package.
+4. Create release tag `vX.Y.Z` and push; workflow will:
+   - set `apps/server/package.json` version to `X.Y.Z`
+   - build web + server
+   - run `bun publish --access public`
+
 ## 1) Dry-run release without signing
 
 Use this first to validate the release pipeline.
-- 
2.54.0