chore: make npm publish build dist and gate on the npm-publish environment#2
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the package publishing pipeline so npm pack / npm publish reliably ships a built dist/, reduces published artifacts by excluding compiled test specs from dist/, aligns documented/runtime Node requirements, and introduces a tag-triggered GitHub Actions publish workflow gated by the npm-publish environment.
Changes:
- Update
tsconfig.jsonexcludes to prevent test/spec sources from being compiled intodist/. - Replace deprecated
prepublishwithprepack(build) +prepublishOnly(test) and addengines.node >= 20. - Add a tag-triggered
Publishworkflow that checks tag/version alignment and publishes with--provenanceunder an environment gate.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| tsconfig.json | Excludes test/spec sources from the TypeScript compile output so dist/ doesn’t include compiled tests. |
| README.md | Updates documented Node requirement to match current support expectations. |
| package.json | Adds Node engine constraint and moves to prepack/prepublishOnly lifecycle hooks for correct publish/pack behavior. |
| .github/workflows/publish.yml | Adds a gated, tag-triggered npm publish workflow with version verification and provenance. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…nment A bare npm publish ships a tarball whose main and types point at dist/index.js and dist/index.d.ts, but the deprecated prepublish hook does not run on npm publish or npm pack under modern npm, so a maintainer who tags and publishes without a local dist/ around ships a broken package. Replacing it with prepack (build) and prepublishOnly (test) restores that guarantee on every pack and publish. The tsconfig exclude for spec files stops compiled test specs riding along in dist as tarball bloat, and the engines field and README pin the supported Node baseline to the versions CI actually runs against. The publish workflow ties a pushed vX.Y.Z tag to a required-reviewer npm-publish environment so the first and every subsequent publish needs maintainer sign-off before npm ever sees a token.
robrigo
force-pushed
the
chore/publish-readiness
branch
from
July 16, 2026 15:13
2ee4eda to
fd89b8b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The deprecated prepublish hook does not run on npm publish or npm pack under modern npm, so a bare publish ships a tarball whose main and types point at a dist/ that was never built. Swapping it for prepack (build) and prepublishOnly (test) closes that gap. Compiled test specs were also riding along in dist as tarball bloat, so the tsconfig exclude drops them. The engines field and the README's Node line are updated to match the versions the CI matrix actually runs. A tag-triggered publish workflow is added, mirroring the shape used by the other SDK repos: it targets a required-reviewer npm-publish environment so a pushed tag queues for maintainer approval before npm ever issues a token, verifies the tag matches package.json's version, and publishes with provenance via OIDC.
Validation
yarn install --frozen-lockfile,yarn build, andyarn testall pass (35 tests).npm pack --dry-runwith dist present shows no test spec files under dist/. Removing dist/ and re-runningnpm pack --dry-runrebuilds it via prepack, confirming dist/index.js and dist/index.d.ts land in the tarball.