Skip to content

publish.md

Latest commit

 

History

History
69 lines (54 loc) · 3.1 KB

publish.md

File metadata and controls

69 lines (54 loc) · 3.1 KB
Raw

HOW TO PUBLISH

Publishing runs in CI (the release job in .github/workflows/ci.yml), right after build-test goes green on main. Locally you only describe and bump.

1. Describe the change

bun run changeset

Interactively select the affected packages (@react-text-game/core, @react-text-game/ui) and the bump type: • patch — bug fixes, minor changes. • minor — backward-compatible features. • major — breaking changes. Write a short description (it will go into the CHANGELOG).

2. Bump versions

bun run version-packages

This consumes the changeset files, rewrites versions and CHANGELOGs, and refreshes bun.lock so CI's --frozen-lockfile install keeps working.

3. Push to main

git add -A && git commit -m "Version Packages" && git push

CI then builds, lints, typechecks, tests, and — only if all of that passes — publishes every package whose version is not yet on npm, pushes the @react-text-game/<pkg>@<version> tags, and creates the matching GitHub Releases.

Nothing gets published when versions are unchanged, so ordinary pushes to main are safe. A release can be re-run from Actions → CI → Run workflow if npm was unavailable.

Fallback: unversioned changesets on main

If a changeset file reaches main without step 2, CI opens a "Version Packages" PR with the bumps instead of publishing. Merge it to release, or drop it and run step 2 locally.

One-time setup

  • NPM_TOKEN repository secret — a granular npm access token with read/write on the @react-text-game scope. GITHUB_TOKEN is provided by Actions automatically.
  • On npmjs.com the packages must allow automation tokens (Settings → "Require two-factor authentication or an automation token"; the "disallow tokens" variant blocks CI publishing).
  • Provenance is enabled via NPM_CONFIG_PROVENANCE, which is why every publishable package carries an explicit repository object with its directory.
  • release is the one script that deliberately skips bunx --bun. --bun also forces the npm publish that changesets spawns onto Bun's runtime, and signing the provenance attestation there dies with ERR_OSSL_NO_DEFAULT_DIGEST (BoringSSL). Plain changeset publish keeps npm on Node, where the signing works.
  • prepack checks that dist exists rather than rebuilding it (scripts/assert-built.ts). It used to run bun run build, which cannot be done safely during a release: changeset publish packs several packages at once, every build begins with rm -rf dist, and the packages that depend on @react-text-game/core compile against the directory core's own build has just deleted. That is not hypothetical — it is what published core@0.11.0 while ui@0.7.0 and devtools@0.1.1 failed with TS2307: Cannot find module '@react-text-game/core'. The workflow builds the whole workspace through Turborepo, in dependency order, immediately before publishing, so dist only needs checking. When a release does fail partway, fix the cause and push: the next run publishes whichever packages are still missing from npm and skips the rest.