Repository navigation
Add CI that tests every change and publishes from main - #1
Merged
Merged
Conversation
Test job runs the self-check on pull requests and on main. It needs no dependencies and no lockfile, and it passes with no device and no socket attached, reporting both as absent. Publish job uses npm trusted publishing over OIDC, so there is no token to store or rotate, and a YubiKey cannot be tapped from CI anyway. npm adds provenance automatically for a public repo published this way. Publishing an existing version fails with 409, so the job only publishes when the version in package.json differs from the registry. Bump the version in the pull request and merging it releases. That suits the branch ruleset, which requires a pull request and blocks direct pushes to main. Drop npm ci from the published example, since this package has no dependencies and no lockfile. Point the test script at node rather than bun, because the plugin now uses only Node standard library modules and node is always present on the runner.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two jobs in one workflow.
test runs
npm test, the in-file self-check, on every pull request and on main. No dependencies, no lockfile, and it passes with no device and no socket attached. That check has caught four real regressions:Bun.connectfailing silently, a cancelled turn repainting cyan, the multiple-choice prompt reading as work, and an icon branch the old test could not detect.publish uses npm trusted publishing over OIDC. No token is stored or rotated, and CI cannot tap a YubiKey, so OIDC is the only workable route with 2FA enabled. npm adds provenance automatically for a public repository published this way.
Deliberate choices
Only publish when the version changed. Publishing an existing version fails with
409, so the job comparespackage.jsonagainst the registry first. Bump the version in the pull request and merging it releases. That fits the ruleset onmain, which requires a pull request.No
npm ci. npm's own example includes it, but this package has no dependencies and no lockfile, so it would fail.node, notbun, for the test script. The plugin now uses only Node standard library modules, and node is always on the runner.No GitHub environment on the publish job. npm encourages one "for projects with maintainers who should not have npm publishing access", which is a multi-maintainer control. With a single maintainer the release is already gated where it matters:
publishruns only onmain, and reachingmainrequires a pull request. An environment would add a second approval granted by the same person.Add one the moment anybody else can merge to
main, because at that point "can merge" and "can release" become the same permission. It is two changes, and they must agree exactly or the publish fails withENEEDAUTH:plus the same environment name in the npm trusted publisher configuration.
Required manual step before the first publish
The workflow will fail with
ENEEDAUTHuntil a trusted publisher is registered. On npmjs.com, under the package Settings, add a GitHub Actions trusted publisher:benkellyopencode-sidepulseci.ymlnpm publishThe filename is case-sensitive and must include the extension. npm does not validate the configuration when saved, so a typo only shows up as a failed publish.
Once a publish has succeeded, consider setting Publishing access to "Require two-factor authentication and disallow tokens". Trusted publishing keeps working, and it closes off token-based publishing entirely.