automate publishing code to npmjs #75
Conversation
|
@rajadilipkolli Added |
|
Hi @sivaprasadreddy , can you please review and merge this PR. |
.github/workflows/build.yml
Outdated
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # Fetch all history for checking version changes | ||
| - name: Check for version change |
There was a problem hiding this comment.
I would suggest to create a separate release.yml GH Action configuration that gets triggered when tagged with *.*.* instead of programmatically checking if version is changed.
There was a problem hiding this comment.
Hi @sivaprasadreddy,
Addressed the same. Can you please review and approve the same.
|
Warning Rate limit exceeded@rajadilipkolli has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 14 minutes and 32 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
WalkthroughThe build workflow matrix now tests Node.js 20.x and 22.x and fixes the matrix variable reference. A new release workflow publishes to npm on semantic version tag pushes, setting up Node 22.x, installing, testing, and publishing with NPM_TOKEN. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant GH as GitHub
participant WF as Release Workflow
participant NPM as npm Registry
Dev->>GH: Push tag (e.g., v1.2.3)
GH-->>WF: Trigger on semver tag
rect rgb(235, 245, 255)
note right of WF: Job: release
WF->>WF: actions/checkout@vX
WF->>WF: setup-node (22.x) + npm registry
WF->>WF: npm ci
WF->>WF: CI=true npm test
end
alt Publish
WF->>NPM: npm publish (auth: secrets.NPM_TOKEN)
NPM-->>WF: 201 Created
else Failure
WF-->>GH: Job fails (logs)
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (9)
.github/workflows/build.yml (3)
20-23: Add dependency caching to speed up CI.Enable setup-node caching for npm installs.
- name: Use Node.js ${{ matrix.node_version }} uses: actions/setup-node@v4 with: - node-version: ${{ matrix.node_version }} + node-version: ${{ matrix.node_version }} + cache: 'npm'
25-27: Prefernpm ciin CI.
npm ciis faster and enforces lockfile consistency.- - run: npm install + - run: npm ci
2-6: Also trigger on pull requests.Current workflow only runs on branch pushes; PRs from forks won’t be validated.
on: push: branches: - '**' + pull_request: + branches: + - '**'.github/workflows/release.yml (6)
9-11: Enable OIDC and publish with provenance (supply-chain hardening).Add minimal job permissions to mint an identity token; then publish with
--provenance.jobs: release: name: Publish to NPM runs-on: ubuntu-latest + permissions: + contents: read + id-token: write
28-31: Attach provenance to the npm package.This adds build attestation; npm supports
--provenancewhen running in GitHub Actions.- - name: Publish to NPM - run: npm publish + - name: Publish to NPM + run: npm publish --provenance env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}Note: keep the chosen secret name in sync with the previous comment.
20-22: Guard against missing lockfile.
npm cifails ifpackage-lock.jsonis absent. Optional fallback:- - name: Install dependencies - run: npm ci + - name: Install dependencies + run: | + if [ -f package-lock.json ]; then npm ci; else npm install --no-audit --no-fund; fi
28-31: Public access for scoped packages (if applicable).If the package name in package.json is scoped (starts with @), add
--access publicor publish will be restricted.- run: npm publish --provenance + run: npm publish --provenance --access publicIf the package is unscoped (e.g.,
generator-springboot), ignore this.
31-31: Add trailing newline.YAMLlint flagged missing newline at EOF.
14-19: Token type recommendation.Use an npm “Automation” token with publish-only scope for least privilege. Classic tokens are broader.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/build.yml(2 hunks).github/workflows/release.yml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
.github/workflows/release.yml
[error] 31-31: no new line character at the end of file
(new-line-at-end-of-file)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: npm test (22.x, windows-latest)
🔇 Additional comments (3)
.github/workflows/build.yml (1)
15-16: Matrix update to Node 22.x/20.x looks good.Keeps CI current while retaining LTS coverage.
.github/workflows/release.yml (2)
1-31: Verify tag/version alignment before publishing.Fail the workflow if the pushed tag (with or without leading "v") doesn't match package.json version — add this as a step before "Publish to NPM" in .github/workflows/release.yml.
#!/usr/bin/env bash set -euo pipefail PKG_VERSION=$(jq -r '.version' package.json) # Use first arg, then GITHUB_REF_NAME, then GITHUB_REF (safe defaults to avoid unbound-var) TAG_REF="${1:-${GITHUB_REF_NAME:-${GITHUB_REF:-}}}" TAG_REF="${TAG_REF##refs/tags/}" TAG_VERSION="${TAG_REF#v}" if [ -z "$TAG_VERSION" ]; then echo "No tag detected (provide tag as arg or run in CI where GITHUB_REF/GITHUB_REF_NAME is set)." >&2 exit 1 fi if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then echo "Version mismatch: package.json=$PKG_VERSION, tag=$TAG_REF" >&2 exit 1 fi echo "Version OK: $PKG_VERSION"Integrate as a workflow step named e.g. "Verify tag matches package.json" immediately before the "Publish to NPM" step.
5-5: Tag filter is using regex-like syntax; it won’t match as intended.GitHub uses glob patterns, not regex.
+has no meaning here and will make the workflow fail to trigger.Use glob patterns that cover common semver tags:
- - '[0-9]+.[0-9]+.[0-9]+' # Matches semantic version tags like 1.2.3 + - '*.*.*' # e.g., 1.2.3 + - 'v*.*.*' # e.g., v1.2.3 + - '*.*.*-*' # e.g., 1.2.3-rc.1 (optional) + - 'v*.*.*-*' # e.g., v1.2.3-beta.0 (optional)Likely an incorrect or invalid review comment.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Steps to be done before merging PR
NPM_AUTH_TOKENSummary by CodeRabbit