JS release workflow - #1821
Conversation
Coverage Report for CI Build 32430635257Coverage remained the same at 86.718%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
74978bd to
16e5f60
Compare
caarloshenriq
left a comment
caarloshenriq
left a comment
There was a problem hiding this comment.
Concept ACK
The workflow structure mirrors the NuGet flow cleanly. Trusted publishing via OIDC, smoke tests on vanilla Node (no nix), and the PAYJOIN_JS_BUILD_TEST_UTILS toggle are all well done.
One thing I noticed: publish-npm calls npm publish without --provenance, but the job already has id-token: write and RELEASING.md step 4 expects a provenance badge on npmjs.com. Does npm@11 enable provenance by default in CI environments, or does it still need the explicit flag? If the latter, the publish step might need:
run: npm publish --provenance "${{ steps.locate.outputs.tarball }}"
benalleng
left a comment
benalleng
left a comment
There was a problem hiding this comment.
CACK, I am unfamiliar with the --provenance flag so I am not totally sure if it is necessary but it does not appear to be a default in v11.
|
|
||
| - name: Attest build provenance (tarball) | ||
| # A consumer runs: gh attestation verify <file>.tgz -R payjoin/rust-payjoin | ||
| uses: actions/attest-build-provenance@v4 |
There was a problem hiding this comment.
For the long term of this we should use actions/attest. There is a note that actions/attest-build-provenance is just a wrapper and it seems that it may be deprecated in the future.
https://github.com/actions/attest-build-provenance#usage
contrib/pack.sh builds the package from the maintained recent lockfile and packs the npm tarball into artifacts/, mirroring how contrib/test.sh drives the test build. The tarball ships only dist/ (wasm + compiled TypeScript), which is platform-independent, so a single pack is the entire release build. The test-utils napi addon is a dev-only helper for the integration tests, so generate_bindings.sh gains a PAYJOIN_JS_BUILD_TEST_UTILS toggle (default on, preserving test behavior) that the pack script switches off.
Add the tag-gated publishing path to the JavaScript workflow, mirroring the NuGet flow in csharp.yml: every run packs the tarball and smoke-installs it on Linux and macOS; pushing a payjoin-javascript-<version> tag additionally reruns the graph at the tagged commit, then publishes the smoke-tested tarball to npmjs.com and attaches it to the GitHub release.
As of v4, actions/attest-build-provenance is just a wrapper around actions/attest, and its README recommends that new implementations use actions/attest directly.
f3b7c8f to
ca59cd9
Compare
4 participants
Builds on top of #1819
Add trusted publishing release workflow for JS bindings.
Co-authored by Claude Fable 5
Pull Request Checklist
Please confirm the following before requesting review:
AI
in the body of this PR.