ci: npm release archives from source + two zips (Refs #35)

jmiller commented

2026-07-18 18:21:03 +00:00

Owner

npm-auto-release.yml now builds two zips (mirroring Joomla): full-repo ${REPO}-${VERSION}.zip and source ${REPO}-${VERSION}-source.zip via git archive, both attached to the release. pre-release.yml cleanly skips npm/MCP repos before any php call.

Refs #35.

Review status

Two review passes run before this PR (code-reviewer + silent-failure-hunter); all Critical/High findings fixed in follow-up commits:

Composite action reads the token via inputs (not the inaccessible secrets context in composite actions).
Fail-closed source-dir resolver: metadata unreachable is distinguished from absent (strict callers hard-fail rather than silently defaulting); a genuine metadata↔Makefile conflict always errors.
Release: set -euo pipefail, non-empty artifact assertions, and gh release upload no longer error-suppressed.

Merge order

#33 (resolver) → #34 (source/ migration) → #35 (release) — #35 references the composite action introduced by #33.

Authored-by: Moko Consulting

`npm-auto-release.yml` now builds **two zips** (mirroring Joomla): full-repo `${REPO}-${VERSION}.zip` and source `${REPO}-${VERSION}-source.zip` via `git archive`, both attached to the release. `pre-release.yml` cleanly skips npm/MCP repos before any `php` call. Refs #35. ### Review status Two review passes run before this PR (code-reviewer + silent-failure-hunter); all Critical/High findings fixed in follow-up commits: - Composite action reads the token via `inputs` (not the inaccessible `secrets` context in composite actions). - **Fail-closed** source-dir resolver: metadata *unreachable* is distinguished from *absent* (strict callers hard-fail rather than silently defaulting); a genuine metadata↔Makefile conflict always errors. - Release: `set -euo pipefail`, non-empty artifact assertions, and `gh release upload` no longer error-suppressed. ### Merge order **#33 (resolver) → #34 (source/ migration) → #35 (release)** — #35 references the composite action introduced by #33. Authored-by: Moko Consulting

jmiller added 3 commits 2026-07-18 18:21:04 +00:00

ci: archive release from source dir and ensure npm setup in release workflows [#35 ] 42c7863997

npm-auto-release.yml:
- Add a "Resolve source directory" step using the composite action
  ./.mokogit/actions/resolve-source-dir (id: srcdir), placed after
  checkout/setup and before the archive/inventory steps.
- Archive from the resolved source dir instead of dist/: strip the trailing
  slash from steps.srcdir.outputs.source_dir and tar with -C "$SRC" .
  (step renamed "Package dist" -> "Package source").
- paths: filter now matches both 'source/**' and 'src/**' (transitional;
  static YAML cannot consume the action output).
- Tool-inventory greps resolve the entrypoint from source_dir + "index.ts"
  with a fallback to src/index.ts when the resolved file is missing.
- registry-url intentionally NOT added: this workflow publishes via GitHub
  Releases (gh release), not npm publish, so no npm auth/registry is used.

pre-release.yml:
- This is the PHP/Joomla pipeline with no Node/npm setup. It already gates
  all build steps on a "Joomla only" eligibility check, so npm repos skip
  the release logic. Added a job-level documenting note directing npm/MCP
  repos to npm-auto-release.yml, and guarded the php-cli/composer apt-get
  install on the absence of package.json so npm repos don't pull the PHP
  toolchain. Low-risk and reversible; platform detection still runs.

Authored-by: Moko Consulting

ci: attach full-repo and source zips to npm release [#35 ] afa5887e4c

Mirror the Joomla two-artifact model for npm/MCP releases: instead of a
single tar.gz, attach two ZIPs to the GitHub Release.

npm-auto-release.yml:
- Replace the tar.gz "Package source" step with "Package release artifacts"
  (id: package) producing:
    * ${REPO_NAME}-${VERSION}.zip        — full repo, tracked files only
      via `git archive --format=zip HEAD` (excludes .git/node_modules/dist).
    * ${REPO_NAME}-${VERSION}-source.zip  — resolved source subtree via
      `git archive --format=zip "HEAD:${SRC%/}"` (tree-ish path, no
      trailing slash). Emits repo_zip / source_zip step outputs.
- Move packaging to run AFTER "Create git tag" and immediately before
  "GitHub Release" so both zips reflect the final released tree (the old
  position ran before the version-badge release commit). Keeps its
  `if: steps.version.outputs.skip != 'true'` guard.
- GitHub Release step now uploads BOTH zips: passed as trailing args to
  `gh release create` and via `gh release upload ... --clobber`.
- Update the header comment to describe the full-repo + source zip
  artifacts instead of the compiled dist/.
- Build / "Verify dist output" steps left as-is (dist still verified in CI).

Authored-by: Moko Consulting

ci: fail-closed release artifacts + npm-safe pre-release guard [#35 ]

Universal: Pre-Release / Build Pre-Release (${{ inputs.stability || github.ref_name }}) (push) Successful in 15s

Details

Branch Policy Check / Verify merge target (pull_request) Successful in 2s

Details

Universal: PR Check / Branch Policy (pull_request) Successful in 2s

Details

Universal: PR Check / Secret Scan (pull_request) Successful in 9s

Details

Universal: PR Check / Validate PR (pull_request) Successful in 7s

Details

Universal: Auto-Assign / Assign unassigned issues and PRs (pull_request_target) Successful in 2s

Details

Generic: Project CI / Lint & Validate (pull_request) Successful in 25s

Details

Branch Cleanup / Delete merged branch (pull_request) Successful in 2s

Details

RC Revert / Rename rc/ back to dev/ (pull_request) Has been skipped

Details

Generic: Project CI / Tests (pull_request) Has been cancelled

Details

Universal: PR Check / Build RC Package (pull_request) Has been cancelled

Details

Universal: PR Check / Report Issues (pull_request) Has been cancelled

Details

a9a8785e3b

Address silent-failure findings from code review in the #35 release work.

npm-auto-release.yml:
- Resolve source directory: pass the now-required action inputs
  (mokogit_token from secrets.MOKOGIT_TOKEN, strict: 'true') so the
  release fails closed if the source dir cannot be resolved.
- Package release artifacts: add `set -euo pipefail`; refuse to build a
  misleading source zip when source_dir resolves empty or to '.'; and
  assert both zips exist and are non-empty before publishing.
- GitHub Release: add `set -euo pipefail` and remove the `2>/dev/null
  || true` suppression on `gh release upload --clobber` so a failed
  artifact upload fails the job instead of advertising a new version
  with stale/missing artifacts. Convert the release-notes fallback to
  an `if` form so it is safe under `set -e`.
- Tool inventory: warn when the resolved entrypoint is missing before
  falling back to src/index.ts, and assert the entry file is readable
  before grep so an unreadable file is not silently counted as 0 tools.

pre-release.yml:
- Add an early npm/MCP detection step (package.json at repo root) that
  runs before any php call; npm repos clean-exit eligibility with
  proceed=false and a notice pointing to npm-auto-release.yml, and skip
  the php platform-detection step entirely (php may be absent on the
  npm fresh-clone path).
- For non-npm repos, warn when platform detection returns empty so an
  eligible Joomla repo is not silently no-op'd. Joomla behavior is
  otherwise unchanged.

Authored-by: Moko Consulting

jmiller merged commit 9d5402ba12 into dev

2026-07-18 18:23:33 +00:00

jmiller deleted branch fix/npm-release-from-source

2026-07-18 18:23:36 +00:00

jmiller referenced this pull request

2026-07-18 18:24:02 +00:00

release: source-dir standardization + npm two-zip release (dev -> main) #39

jmiller referenced this pull request

2026-07-18 18:25:24 +00:00

ci: release workflows — npm setup + archive from source dir (not dist) #35

ci: npm release archives from source + two zips (Refs #35) #38

Review status

Merge order