ci: publish to npm when a release is published - #304
Merged
Conversation
npm is moshcode's second distribution channel — the first is `curl … install.sh | sh` — and that is exactly why it cannot be a manual step. A channel that updates only when someone remembers is one that serves an old version forever, silently, to everyone who found the package instead of the install script. 0.24.0 was published by hand; nothing would have published 0.25.0. The GitHub release is the trigger, so there is no second thing to remember. Three guards, because npm will not let a version be replaced: - the tests run first, on the exact tree about to be packed - a release tag that disagrees with package.json fails rather than publishing the wrong tree under a version nobody can reuse - a version already on the registry is skipped, so re-running a release that failed on something transient is harmless rather than an E403 Publishes with provenance, signed by a short-lived OIDC token rather than anything stored in the repo. Needs a repository secret NPM_TOKEN — an npm automation token. Until that is set the job fails with a message saying so, rather than a bare 401. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan92 finding(s) HIGH/CRITICAL: 50 | MEDIUM: 42
…and 42 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This was referenced Aug 5, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
.github/workflows/publish.yml, which publishes to npm on a published GitHub release.npm is moshcode's second channel — the first is
curl … install.sh | sh— and that is exactly why it cannot be manual. A channel that updates only when someone remembers serves an old version forever, silently, to everyone who found the package instead of the install script. v0.24.0 was published by hand; nothing would have published v0.25.0.Guards
npm will not let a version be replaced, so the job is deliberately cautious:
package.jsonversionNPM_TOKENfails with a plain messagePublishes with
--provenance, signed by a short-lived OIDC token (id-token: write) rather than anything stored in the repo. The repo is public, so provenance is available.Required before it can work
NPM_TOKEN— an npm automation token (the kind that publishes without a 2FA prompt). There are currently no repository secrets set. Until it exists the job fails with an explicit message naming the missing secret.Verification
release: [published]andworkflow_dispatchtest.ymlexactly, including thepackageManager/pnpm pinning caveatmoshcode@0.24.0→ skip,moshcode@0.25.0→ proceed🤖 Generated with Claude Code