Releases are published by .github/workflows/release.yml. The
workflow runs only when a GitHub release is created or when a
maintainer starts it with workflow_dispatch; pushes to main do not
publish packages.
Before publishing, the workflow installs dependencies and runs formatting, lint, typecheck, tests, and the full build. It then checks the npm registry for each package's exact current version. Existing versions are skipped, while unpublished versions are packed and published in dependency order.
npm Trusted Publishing must be configured separately for each package:
@payments-sdk/core@payments-sdk/esewa@payments-sdk/fonepay@payments-sdk/khalti@payments-sdk/payments
On each package's npm settings, add a GitHub Actions trusted publisher with:
- Organization or user:
neplextech - Repository:
payments-sdk - Workflow filename:
release.yml - Environment name: leave empty unless the workflow is later protected by a GitHub environment
- Allowed action:
npm publish
The workflow filename is entered as release.yml, not the full
.github/workflows/release.yml path. The package repository field
must also remain exactly aligned with
https://github.com/neplextech/payments-sdk.
An npm package must exist before its trusted publisher can be configured. The first version therefore requires an authenticated maintainer bootstrap through npm. After that bootstrap, configure Trusted Publishing for the package and use the workflow for subsequent versions.
The workflow uses GitHub Actions OIDC and does not require an
NPM_TOKEN. Once Trusted Publishing is working, disable conventional
token publishing in the npm package settings where appropriate.