Repository navigation
ci(node): add the npm release workflow - #16
Merged
Merged
Conversation
added 3 commits
September 22, 2026 15:09
Mirrors python-release.yml: on a published node-v* GitHub Release, run the supported-version test matrix, verify and pack, then publish from the `npm` environment with OIDC trusted publishing and provenance, and smoke-test the published package. Release logic lives in scripts, not YAML: - scripts/verify.mjs: tag matches package.json's version, `private` is off, CHANGELOG.md has an entry for the version, repository.url is set (provenance requires it), and optionally npm is new enough for trusted publishing. The publish job asserts the npm version instead of installing npm from the registry at publish time. - scripts/smoke.mjs: install the published version into a temporary project with retries, import it, check the public exports and the installed version. package.json gains repository/homepage/bugs (provenance verifies repository.url against the publishing repository) and publishConfig.access=public, which a scoped package needs on first publish. Nothing publishes until a node-v* release is created, the `npm` GitHub environment exists with required reviewers, and the npm trusted publisher is configured for the package.
Node refuses to spawn .cmd shims directly (spawnSync npm.cmd EINVAL), which failed the --require-npm check on the Windows CI runners.
Same shape as scripts/java_dev.py: a small stdlib-only Python script for the step npm has no command for. The release gate stays in node/scripts/verify.mjs (npm run verify, with its tests); everything else is plain npm in the workflow. - smoke VERSION installs the exact published version into a temporary project and checks the public exports. It retries 20 times, 40s apart (about 13 minutes), with a fresh npm cache and --prefer-online each time, logging 'install attempt X/20 failed (registry may lag the upload)': the registry has taken around 8 minutes to serve a newly published tarball. - Replaces node/scripts/smoke.mjs. - The publish job gains a repository_owner guard, so a fork can never publish, and the build job packs into node/pack/ for the publish job.
mwaisaida-13
marked this pull request as ready for review
September 24, 2026 19:36
python.yml watched scripts/**, so a change to another language's runner (scripts/node_dev.py) also ran the Python matrix. Watch scripts/python_dev.py, like java.yml watches scripts/java_dev.py.
edlng
reviewed
Sep 24, 2026
added 3 commits
September 24, 2026 23:47
verify.mjs: - Accept X.Y.Z and X.Y.Z-rc.N only. Release candidates publish under the `next` dist-tag (verify writes dist_tag to GITHUB_OUTPUT and the publish step passes it), so `latest` keeps pointing at the last full release. Any other prerelease suffix is rejected in the gate; npm itself refuses a prerelease without an explicit --tag, which would only fail at the upload. - Reject --require-npm without a value; it silently skipped the npm check. - Reject non-numeric version parts instead of comparing NaN, which passed silently. Tests: runVerify takes an env parameter; cases for each of the above.
verify accepts X.Y.Z and X.Y.ZrcN (PEP 440) and rejects any other suffix (.devN, aN, bN). pip skips pre-releases unless one is requested explicitly, so an RC on PyPI never reaches a plain pip install and needs no separate channel.
npm refuses to publish a prerelease version without an explicit dist-tag, so verify.mjs now fails on any version with a prerelease suffix and the publish step no longer needs a computed --tag. The Python gate applies the same rule (X.Y.Z only). Prereleases are never required before a release.
alexr-bq
approved these changes
Sep 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
node-release.yml, which publishes the Node package to npm on a publishednode-v*GitHub Release, following npm'strusted publishing guide.
Flow: supported-version test matrix → verify and pack → publish from the
npmenvironment (OIDC, provenance) → post-publish smoke test.
npm run list-supported-versions(existing)npm run verify→node/scripts/verify.mjs: tag matches the version,privateis off,CHANGELOG.mdhas the entry,repository.urlis set, npm ≥ 11.5.1 on the publishing runnerscripts/node_dev.py smoke: installs the exact published version into a temporary project, retrying 20 × 40 s for registry lag, and checks the public exportspackage.jsongainsrepository/homepage/bugsandpublishConfig.access: public.The publish job only runs in
aws/developer-toolkit-elasticache, never in a fork.Prerelease versions
npm refuses to publish a prerelease version without an explicit
--tag, soverifyrejects any version with a prerelease suffix. Only
X.Y.Zreachesnpm publish. ThePython gate applies the same rule.
Verification
npm test: 103 passed; lint, format and typecheck clean.verifyon the current package stops at the"private": trueguard.end to end on a test package.
Before the first release
existing package), by a member of the
awsnpm org.aws/developer-toolkit-elasticache,node-release.yml, environmentnpm) and allownpm publish.npmenvironment with required reviewers."private": true, set the version, add the CHANGELOG entry.