Repository navigation
feat(library): package @vivswan/github-settings-as-code - #142
Merged
Merged
Conversation
Contributor
File size check0 over a hard cap (fails), 90 warning(s).
Split the file, wrap the line, shorten or exempt the comment, or list the path in 5 managed file(s) skipped; repo-platform owns them. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Vivswan
force-pushed
the
refactor/flows-library
branch
2 times, most recently
from
September 11, 2026 22:46
6bc1674 to
649afb3
Compare
Vivswan
force-pushed
the
feat/library-package
branch
2 times, most recently
from
September 11, 2026 23:18
a78f0db to
11757a2
Compare
Vivswan
force-pushed
the
refactor/flows-library
branch
from
September 12, 2026 01:11
649afb3 to
801c7ec
Compare
Vivswan
force-pushed
the
feat/library-package
branch
from
September 12, 2026 01:20
11757a2 to
d45b6fa
Compare
Vivswan
force-pushed
the
feat/library-package
branch
from
September 12, 2026 01:39
d45b6fa to
a3d764a
Compare
There was a problem hiding this comment.
🟡 Changes recommended
The documented trusted-publishing setup cannot bootstrap the package's first npm release.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Packages the existing engine as an ESM npm library with validated artifacts, CI smoke testing, release version synchronization, and consumer documentation.
Changes:
- Adds the tsdown library build and npm manifest exports.
- Adds package validation, consumer smoke tests, and CI gating.
- Documents the public API, installation, and release process.
File summaries
| File | Description |
|---|---|
tsdown.config.ts |
Configures the ESM library build. |
package.json |
Defines npm metadata, exports, scripts, and dependencies. |
bun.lock |
Locks the new packaging tools and dependencies. |
.gitignore |
Excludes generated library artifacts. |
knip.json |
Delegates public-entry discovery to tsdown. |
src/index.ts |
Exports declaration-required plan types. |
src/sections/contract/plan.ts |
Makes referenced plan types public. |
.github/scripts/package-smoke.ts |
Builds and validates an installed package. |
.github/workflows/checks.yml |
Adds the package smoke CI gate. |
release-please-config.json |
Synchronizes the package version during releases. |
test/package-json.test.ts |
Pins the publishable manifest contract. |
test/library/package-smoke.test.ts |
Tests smoke-script helpers. |
test/library/public-surface.test.ts |
Pins the expanded public type surface. |
test/docs/readme.test.ts |
Verifies library documentation links. |
test/docs/guides.test.ts |
Registers and validates the library guide. |
docs/reference/library.md |
Documents installation, APIs, and publishing. |
README.md |
Introduces the npm library. |
docs/README.md |
Adds library documentation navigation. |
AGENTS.md |
Records repository packaging conventions. |
Review details
- Files reviewed: 17/19 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
🟡 Changes recommended
The documented first publish can produce an immutable package whose exported library files are absent.
Get a fresh assessment by requesting another Copilot review.
Review details
- Files reviewed: 17/19 changed files
- Comments generated: 1
- Review effort level: Balanced
Vivswan
force-pushed
the
feat/library-package
branch
3 times, most recently
from
September 12, 2026 01:54
a18dc70 to
379c9b1
Compare
There was a problem hiding this comment.
🟡 Changes recommended
Packaged Git refs omit lib/pkg, causing the documented GitHub package installation to fail.
Get a fresh assessment by requesting another Copilot review.
Review details
- Files reviewed: 17/19 changed files
- Comments generated: 1
- Review effort level: Balanced
added 4 commits
September 11, 2026 23:10
Publish the engine as an ESM-only npm library beside the action: - package.json becomes the npm manifest (scoped name, version mirroring .release-please-manifest.json, exports map, files, publishConfig); the action-only @actions packages move to devDependencies. - tsdown builds src/index.ts to lib/pkg/index.js plus one index.d.ts (bun run build:lib; built, not committed). - .github/scripts/package-smoke.ts builds, runs publint and attw, packs, installs into a fresh consumer, imports under Node, and typechecks with skipLibCheck off; checks.yml runs it as the package-smoke job. - release-please rewrites package.json version through a json extra-file. - docs/reference/library.md documents install lines, the API by group, versioning, and the one-time trusted-publishing setup.
The bundled declaration build (tsdown, dts: true) fails with TS4023 when a type reachable from the public entry is not exported from its module: every section module carries PlannedOpBase, Tolerance, Unverifiable, and Justification from src/sections/contract/plan.ts in its type. Export the four, re-export them as types from src/index.ts, and pin them in the public-surface test.
The package is not published yet and the build branch carries no lib/pkg/, so the install and versioning sections now say the library is built here with bun run build:lib and that npm and packaged-branch installation arrive with the publishing change. The API-by-group content is unchanged.
added 3 commits
September 11, 2026 23:10
main now takes { token, io?, baseUrl?, apiVersion? }; the positional form
compiled against the old signature and left the client unauthenticated.
A trusted publisher can only be added to a package that already exists on npm, so the setup section now starts with the manual first publish.
Every fallible call now returns a neverthrow Result or ResultAsync with a typed Problem: the library page examples and the package-smoke consumer snippets read .isOk()/.isErr()/.value/.match and render problems with describeProblem; readSettingsFile takes the file role and the check example passes a SectionSelection.
Vivswan
force-pushed
the
feat/library-package
branch
from
September 12, 2026 03:28
379c9b1 to
6ea8aa1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
package.jsonis now the npm manifest: scoped name,versionmirroring.release-please-manifest.json, exports map,files,publishConfig,engines(Node 22.14+), ESM only. A newtest/package-json.test.tspins the field set and the version equality.bun run build:lib(tsdown,tsdown.config.ts) bundlessrc/index.tsintolib/pkg/index.jsplus oneindex.d.ts, runtime dependencies external. Built, never committed (gitignored besidelib/index.js). The action bundle is untouched..github/scripts/package-smoke.tsbuilds, runspublint --strictandattw --profile esm-only, packs, installs the tarball into a fresh consumer, imports it under Node (entry and schema subpath), and typechecks a consumer withskipLibCheck false.checks.ymlruns it as thepackage-smokejob, so all-green covers it.@actions/artifactand@actions/coremove to devDependencies (only the action bundle inlines them);@octokit/typesand@octokit/openapi-typesmove to dependencies because the bundled d.ts imports@octokit/types.package.json$.versionthrough a json extra-file; the docs marker test now filters string entries and pins that one json entry.docs/reference/library.md: install lines, the API by group with one example each, versioning, and the one-time trusted-publishing setup. README gains a short Library section. Nothing is published by this PR.Technical details
refactor/flows-library(stacked).build:libfails on that base today with TS4023:PlannedOpBase,Unverifiable,Tolerance(andJustification) insrc/sections/contract/plan.tsare referenced by every exported section module but not exported, so the declaration emitter cannot name them. That fix belongs to the base branch;package-smokestays red here until it lands. With those four exports applied locally, the full smoke passes end to end (build, publint, attw, pack, install, Node import, tsc).repositoryis the object form ({type: "git", url: "git+https://..."}): publint --strict rejects the baregit+httpsstring.fixedExtensionis off so the outputs areindex.jsandindex.d.ts(the package istype: module);deps.neverBundlelists every runtime dependency and its subpaths.npm pack --jsonprints an array under npm 11 and an object keyed by package name under npm 12; the smoke reads both.--ignore-scriptskeeps the prepare hook's output out of the JSON.prepareislefthook install || trueso agithub:install (which runs prepare) survives a tree without lefthook.src/index.tsleft the explicit entry list because the tsdown plugin already reports it as an entry;lint:packageis the package.json home for publint and attw so knip sees the binaries.github:Vivswan/github-settings-as-code#<sha>install form documented on the library page needs the packaged branch to carrylib/pkg/; the page says so.Reviewer note (Copilot): report a finding only with a concrete input and the wrong output it produces.