Repository navigation
Publish explicit numbered v1.0.0 alpha versions safely #385
Description
Part of #382 — v1.0.0 alpha readiness.
Problem
The current workflow starts from 0.1.0, appends -alpha-<commit>, and always publishes to alpha: .github/workflows/release.yml:57-L86. The LLM documentation independently constructs an alpha/hash version: docs/llm.js:145-L155.
The target is the 1.0.0-alpha.N series while ReScript 13 remains in alpha. A stable compiler and beta/stable publication are not prerequisites for this issue.
Acceptance criteria
- Choose one explicit source of truth for the release version, starting with
1.0.0-alpha.1(Git tagv1.0.0-alpha.1). - Keep package metadata, lockfile metadata where applicable, generated documentation, and release/tag instructions consistent with the chosen version.
- Validate that an alpha release version is published only to npm's
alphadist-tag; never advancelatestduring alpha publication. - Retain a non-publishing dry-run path for PRs/manual checks and retain the main-branch guard for real publication.
- Run formatting, build, feature, runtime, docs, and packed-consumer validation before publication.
- Dry-run the exact artifact intended for publishing; fail clearly on version/channel mismatch or already-published versions.
- Document tag/release-note/changelog steps, required publishing configuration, and how to verify the resulting dist-tag.
- Confirm provenance/trusted-publishing setup rather than assuming workflow YAML alone proves it works.
Boundaries
This issue implements and verifies release machinery. Closing it does not by itself authorize publishing a package. Do not broaden the alpha work into a full beta/stable promotion system unless explicitly chosen.
Release validation must incorporate #384 (actual tarball consumers) and #383 (reliable runtime checks).
Activity
jderochervlk commentedon Nov 5, 2026
Maintainer-only release gate identified during implementation: the agents can implement and review the workflow, but cannot confirm npm account-level trusted-publisher configuration from the workspace. This acceptance item remains unverified; no package has been published and no account settings have been changed.
Please inspect the Trusted Publisher section in the npm settings for
@rescript/webapiand confirm:rescript-langexperimental-rescript-webapirelease.yml— npm expects only the filename; the repository path is.github/workflows/release.yml.npm publishmust be permitted, not only staged publication. Standalone dist-tag-management permission is not needed unless the workflow actually uses it.The planned workflow restricts real publication to
refs/heads/main, requestsid-token: write, and uses npm provenance. Those code settings do not establish that npm trusts the workflow or prove a successful provenance-bearing publication. Actual published provenance must be checked after a separately authorized release.No credentials or tokens should be posted. A maintainer's confirmation of the configured identity is sufficient for the account-configuration check. Implementation and independent code review can proceed while this external gate remains open.
Reference: https://docs.npmjs.com/trusted-publishers/
build(webapi): fix alpha installs and release checks [Codex] (#397)
docs(webapi): update alpha guides and fix broken links [Codex] (#398)
jderochervlk commentedon Nov 8, 2026
The repository work is merged in #397 and #398. Numbered alpha metadata, the alpha-only publish path, exact-tarball validation, release guards and the release guide are implemented. Release validation passed on the same source tree now on main, and main CI is green.
Leaving this issue open for the last acceptance item: a maintainer must confirm npm Trusted Publishing for
@rescript/webapi, GitHub ownerrescript-lang, repositoryexperimental-rescript-webapi, workflow filenamerelease.yml, no environment, with direct publishing allowed. The workflow alone does not prove the npm account is configured. Please confirm the settings without posting credentials.The registry currently has
alphaat0.1.0-alpha-b1d58f9andlatestat0.1.0-experimental-29b94b3. No v1 alpha publication is being claimed. Actual publication and its provenance/dist-tag verification remain a separate authorized release step tracked in #382.