Conversation
Contributor
|
gnidan
force-pushed
the
build-npm-prerelease
branch
from
September 15, 2026 17:39
abf9ee0 to
bf8f4bb
Compare
Give the seven public packages the fields npm and its consumers need: `files` limited to `dist` (minus the incremental build info), `engines`, a full `repository` entry with `directory`, a LICENSE copy, and a README that states the supported TypeScript resolution modes (node16, nodenext, bundler). Declare the runtime dependencies that were only devDependencies or an optional peer: pointers on format, evm on pointers, bugc on ethereum-cryptography. Each of those packages failed to import when installed alone. Run bugc's CLI from `dist/bin/bugc.js` with a node shebang; the source shebang needed tsx, which consumers do not have. Mark conformance private: it is a test harness, not a library.
`src/test-cases.ts` imported the `test/` helpers, so it could not stay in the shipped tree once `test/` is excluded from the build. It lives in `test/` now; the integration test, the example runner, and the four docs pages that embed it follow.
Each public package gets a `tsconfig.build.json` that includes only `src/` (plus `bin/` for bugc), excludes tests, turns off declaration maps, and restates its project references against the sibling build configs: references are not inherited through `extends`, and `tsc --build` needs them to build dependencies first. One `build` script per package does the generation step, wipes `dist/`, and compiles; `prepare` calls it, so a fresh install and a publish produce the same clean output. Root `build` runs the package builds in dependency order through Lerna, skipping the private packages; root `test` runs vitest once. A root `nx.json` makes Lerna resolve the workspace root inside a git worktree instead of the shallowest ancestor that contains nx. format's `watch` no longer starts with the clean build, which raced the other watchers.
tsc does not copy CSS, so the React packages' stylesheets were absent from anything built from `dist/`. The build now copies `src/**/*.css` into `dist/src/`, bugc-react exports the new path, and the playground imports it.
`checkPackList` accepts only `package.json`, README, LICENSE, `dist/src/**` and `dist/bin/**`, and rejects anything that looks like a test or build info. `packList` runs `npm pack --dry-run --json` and reads the last JSON array, because a package's `prepare` script prints before it. Tests live in a root `bin` vitest project.
`publish-tagged.ts` reads the Lerna tags that point at HEAD, maps them to public workspaces, checks each tag against the manifest version, and publishes in dependency order with `npm publish --access public --tag latest`. The explicit tag is required: npm 11 refuses to publish a prerelease version without one. Provenance is requested only under GitHub Actions. Before each publish the script asks the registry for the package's versions and skips one that is already there, so a re-run after a partial failure is safe; any other registry error aborts the run. It also checks the pack list, prints published, skipped and failed summaries, and warns about a tag that names no workspace. Lerna's own publish command is not used: it cannot exchange the GitHub OIDC token for npm credentials.
`check-tarballs.ts` runs the allow-list check on every public package. `smoke-tarballs.ts` goes further: it packs each package, installs it alone in a temporary directory with only its sibling tarballs, imports it, and runs bugc's CLI. The allow-list sees file names only; the smoke test is what catches a runtime dependency declared as a devDependency, which the workspace's hoisted node_modules and the registry's stale 0.1.0-0 builds would otherwise hide.
The publish job needs Node 22 for npm 11, so the test suite runs on both versions. The tarball checks run after the tests.
Lerna pushes the Publish commit and its tags in one atomic push, and GitHub creates no tag events when more than three tags arrive at once, so the workflow triggers on pushes to main. A short `check` job looks for package tags at HEAD and gates the publish job, which installs npm 11 for trusted publishing, runs the tests, and calls `publish-tagged.ts`. A manual dispatch defaults to a dry run.
gnidan
force-pushed
the
build-npm-prerelease
branch
from
September 15, 2026 18:26
a4b9021 to
3a86ef1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What ships: the seven public packages get
fileslimited todist/(minus.tsbuildinfo),engines, a fullrepositoryentry, a LICENSE copy, and a README; conformance becomes private; bugc's CLI now runs fromdist/bin/bugc.jswith a node shebang.What changes for developers: each public package builds from a new
tsconfig.build.jsonthat excludes tests, via a single cleanbuildscript thatpreparecalls; rootyarn buildis nowlerna run build --no-private; pointers' test cases move totest/; the React packages copy their stylesheets intodist/.How publishing works:
yarn lerna version prerelease --no-push --no-commit-hooksbumps and tags locally, a manualgit push --atomic origin main --follow-tagslands them, andpublish.ymlpublishes every package tagged at HEAD with the npm CLI under trusted publishing. A tarball allow-list runs in CI on Node 20 and 22 and again before each publish.First release: trusted publishers are configured on the two packages that already exist; the five new ones need one local publish, after which CI handles everything.