Skip to content

ci: unify preview and release into a single workflow#7

Merged
rqbazan merged 1 commit into
mainfrom
fix/unify-release-workflow
Jun 29, 2026
Merged

ci: unify preview and release into a single workflow#7
rqbazan merged 1 commit into
mainfrom
fix/unify-release-workflow

Conversation

@rqbazan

@rqbazan rqbazan commented Jun 29, 2026

Copy link
Copy Markdown
Member

What

Unify preview.yml and release.yml into a single release.yml so all publishing happens from one workflow file — required because npm trusted publishing / provenance is bound to the workflow filename, and the split meant only preview.yml matched it.

  • preview.yml deleted; its job moved into release.yml as the preview job.
  • Event gating added (the part that was unfinished): release runs only on push to main; preview runs only on qualifying pull_requests. Before, the release job had no event guard and would also fire on every PR (minting the bot token + running changesets on PRs).

Still needed on the npm side (not in this PR)

  1. Repoint the npm Trusted Publisher for @vlandoss/theme-toggle from preview.ymlrelease.yml.
  2. Stable publish auth — pick one:
    • OIDC trusted publishing (tokenless, auto-provenance, bypasses 2FA → fixes the earlier 403): needs npm CLI ≥ 11.5.1 / a pnpm 10.x that supports OIDC (10.6.4 likely doesn't), and NPM_TOKEN removed from the release job. Node ≥ 22.14.0 is already satisfied by the 24.16.0 pin.
    • Keep the automation token: set the package's publishing access to "require 2FA or an automation token" so the token is accepted.

The release job currently keeps NPM_TOKEN as a functional baseline; tell me which auth model you want and I'll finalize it.

🤖 Generated with Claude Code

Merge preview.yml into release.yml as a second job so all publishing
happens from one workflow file (needed for npm trusted publishing /
provenance, which is bound to the workflow filename).

Gate each job by event: 'release' runs on push to main (changesets version
PR / publish), 'preview' runs on qualifying pull requests. Previously the
release job had no event guard and would also fire on PRs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@changeset-bot

changeset-bot Bot commented Jun 29, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: dff6408

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@vland-bot

vland-bot Bot commented Jun 29, 2026

Copy link
Copy Markdown
Contributor

Preview release

Latest commit: dff6408

Some packages have been released:

Package Version Install
@vlandoss/theme-toggle 1.0.1-git-dff6408.0 @vlandoss/theme-toggle@1.0.1-git-dff6408.0

Note

Use the PR number as tag to install any package. For instance:

pnpm add @vlandoss/theme-toggle@pr-7

@rqbazan rqbazan merged commit fe5cdec into main Jun 29, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant