chore(ci): add npm publish job to version-release workflow#6
chore(ci): add npm publish job to version-release workflow#6Atharva0506 wants to merge 1 commit into
Conversation
|
Warning Review limit reached
Next review available in: 43 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThe release workflow now supports manual execution, verifies actor permissions, automatically creates missing GitHub releases, and conditionally builds, verifies, and publishes the package to npm. ChangesRelease pipeline
Estimated code review effort: 3 (Moderate) | ~20 minutes Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
no-issue-linked
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/version-release.yml:
- Line 25: Pin every action reference in .github/workflows/version-release.yml
to an immutable commit hash while retaining the current version tag as a
readability comment: update actions/checkout at lines 25 and 155,
actions/github-script at lines 31 and 85, and actions/setup-node at line 160.
- Around line 144-147: Add environment: npm to the publish job in the
version-release workflow so its environment-scoped NPMJS_TOKEN and protection
rules apply. Also verify the repository contains the package.json and
package-lock.json files needed by the publish job’s npm ci, npm run build, and
npm test steps.
- Line 9: Add a workflow-level concurrency group to the version release
workflow, using a stable release-specific key so runs triggered by rapid VERSION
changes are serialized. Configure the concurrency behavior to prevent
overlapping runs while preserving the existing tag-check and tag-creation steps.
- Around line 18-22: Add an explicit permissions block to the release job in
version-release.yml, granting contents: write. Place it at the job level so the
tag-push and GitHub release steps have the required permission without relying
on repository defaults.
- Around line 24-28: Configure authentication for the tag push in the
version-release workflow: either remove persist-credentials: false from the
actions/checkout step or explicitly configure the origin remote with
GITHUB_TOKEN before the git push step. Ensure the existing v$VERSION tag push
can authenticate successfully.
- Line 89: Move GitHub Actions expression expansion out of script bodies and
into environment blocks. At `.github/workflows/version-release.yml` lines 89-89,
update the release job script using `const version` to read
`process.env.VERSION` and define `VERSION` in that step’s `env`; at lines
179-179, update the publish sync step to use the environment-backed `VERSION`
value and define it in that step’s `env`, preserving the existing version
sources.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 7c7f788d-8826-4181-a717-4ed49022fdd2
📒 Files selected for processing (1)
.github/workflows/version-release.yml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
AOSSIE-Org/ThruBox-Server(manual)
Aligned with the AOSSIE npm package standard (IndexedDB-Import-Export): - Added maintainer verification step (checks write access) - Added auto-create fallback when no draft release exists - Added 'publish' job that runs after successful release: - Installs deps, builds, tests, verifies package contents - Syncs version from VERSION file to package.json - Publishes to npm with --provenance for supply-chain attestation - Requires NPMJS_TOKEN secret and 'npm' environment - Updated actions/checkout to v4, actions/github-script to v7
aedde7f to
3594a80
Compare
1 participant
Aligned with the AOSSIE npm package standard (IndexedDB-Import-Export):
The existing
version-release.ymlonly creates tags and GitHub releases but does not publish the package to npm.Addressed Issues:
Fixes #(issue number)
Screenshots/Recordings:
Additional Notes:
Aligned with the AOSSIE npm package standard used by IndexedDB-Import-Export:
publishjob that runs after successful release:VERSIONfile topackage.json--provenancefor supply-chain attestationNPMJS_TOKENsecret andnpmGitHub environmentactions/checkoutto v4,actions/github-scriptto v7Checklist
We encourage contributors to use AI tools responsibly when creating Pull Requests. While AI can be a valuable aid, it is essential to ensure that your contributions meet the task requirements, build successfully, include relevant tests, and pass all linters. Submissions that do not meet these standards may be closed without warning to maintain the quality and integrity of the project. Please take the time to understand the changes you are proposing and their impact.
Summary by CodeRabbit
New Features
Improvements