chore(js): first npm release, staged publishing for every release after - #301
Draft
schloerke wants to merge 3 commits into
Draft
chore(js): first npm release, staged publishing for every release after#301schloerke wants to merge 3 commits into
schloerke wants to merge 3 commits into
Conversation
release-js.yaml now runs `npm stage publish` instead of `npm publish`: CI uploads a pending tarball and a maintainer approves it with 2FA, which CI cannot do. Auth moves to npm trusted publishing (OIDC), so there is no NPM_TOKEN secret and provenance is automatic. Requires npm 11.15+, so the workflow upgrades past the npm 10.x that Node 22 bundles.
schloerke
changed the title
schloerke
marked this pull request as draft
September 11, 2026 20:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes
1.
pkg-js/package.json0.0.1 → 0.1.0 — first release of@posit-dev/shinyreact.2.
release-js.yamlpublishes nothing; it stages.npm publish→npm stage publish. CI uploads a pending tarball and stops; a maintainer approves it withnpm stage approve <stage-id>(or the Staged Packages tab), which requires 2FA and so cannot be automated. An unapproved stage never publishes — that is how a bad release gets abandoned, with nonpm unpublishwindow to race.Auth moves to npm trusted publishing (OIDC) at the same time, so:
NPM_TOKENsecret — nothing to leak or rotate--provenanceflag is gonenpm stage publishas the only allowed action, so this workflow cannot be made to publish directly even if someone edits itAlso: the job is renamed
publish→stage, and npm is upgraded to 11.x becausenpm stageand OIDC need 11.15+ while.nvmrc's Node 22 bundles npm 10.x.Bootstrap: 0.1.0 is published by hand
Neither feature can be used for this release. npm cannot stage a package that does not exist yet ("you cannot stage a brand-new package"), and a trusted publisher is configured on a package's settings page, which likewise needs the package to exist. So 0.1.0 gets published manually from a maintainer's laptop, and there is no
js/v0.1.0tag — pushing one would only trigger a job that fails on a version already taken. Releases from 0.1.1 on follow the staged flow.Skill
.claude/skills/release-shinyreact/SKILL.mdgets the approval handoff, thenpm stagecommands, the trusted-publishing setup, and the bootstrap exception. It also now says explicitly that a greenrelease-jsrun means staged, not released — so a future agent doesn't report a JS release as done off a green check.Not in scope
Python and R versions are untouched.
make update-dist update-skills update-exampleswas clean against main, so the vendored bundles already match this source.