bitpool/workflows-public

Reusable GitHub Actions workflows that need to be callable from public repositories.

Why this repo exists

bitpool/workflows is private, and a reusable workflow stored in a private repository can only be called by other private repositories. A public caller fails at startup with no jobs, no logs and no annotations — indistinguishable from a parse error.

So anything a public repo must call lives here instead. Everything else stays in bitpool/workflows, which is where org infrastructure details belong.

Keep this repo free of anything that should not be world-readable: no role names, cluster names, namespaces, hostnames or account IDs.

What's here

.github/workflows/
└── npm-publish.yml   # publish a package to npm, then tag + release

npm-publish.yml

Publishes to the public npm registry, then tags the commit and cuts a GitHub Release.

on:
  push:
    branches: [main]

jobs:
  publish:
    uses: bitpool/workflows-public/.github/workflows/npm-publish.yml@v1
    permissions:
      contents: write   # tag + release
      id-token: write   # provenance
    with:
      provenance: true  # public repos only
    secrets: inherit

Trigger it on every push to the default branch: the workflow checks npm for name@version from package.json first, so a push that does not bump the version is a no-op rather than a failure. Bumping the version is what publishes.

Inputs

input	default	notes
node_version	"22"	Must satisfy the package's engines.node
provenance	false	Public source repos only
dry_run	false	npm publish --dry-run, no tag or release
create_release	true	Tag + GitHub Release after a successful publish
working_directory	"."	Directory holding package.json
environment	""	GitHub Environment to run in; empty means none
timeout_minutes	15

Requires an NPM_TOKEN secret with publish rights to the package's scope.

Things that are easy to get wrong

• node_version must satisfy engines.node. npm only warns on a mismatch, so the run stays green and the wrong runtime is baked into the published metadata (_nodeVersion).
• provenance needs a public repo and a matching repository field in package.json. npm rejects a private source with Unsupported GitHub Actions source repository visibility: 'private', and rejects a repository that does not match where it is publishing from.
• Grant the permissions in the caller. Where the org default is default_workflow_permissions: read, omitting contents: write / id-token: write produces startup_failure with zero observability.
• Environment secrets beat org secrets of the same name. A stale NPM_TOKEN left in an environment silently wins over the org one.

Versioning

Callers pin the major tag:

uses: bitpool/workflows-public/.github/workflows/npm-publish.yml@v1

Releases are tagged v1.2.3 with v1 moved to match. Minor bumps add inputs with defaults; major bumps may break callers.