@_linked/org 1.1.0 → 1.1.1

package/.gitattributes

@@ -0,0 +1 @@
+package-lock.json linguist-generated=true -diff merge=ours

package/.github/workflows/pr.yml

@@ -0,0 +1,18 @@
+name: PR
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  checks:
+    uses: linked-fw/.github/.github/workflows/pr.yml@v1
+    # The changeset reminder posts a PR comment. A reusable workflow only holds what its
+    # caller granted, and the org default is read-only.
+    permissions:
+      contents: read
+      pull-requests: write
+    with:
+      require-tests: false
+      run-e2e: false

package/.github/workflows/publish.yml

@@ -1,3 +1,8 @@
+# Calls the shared workflow in linked-fw/.github.
+#
+# This FILENAME is what npm's trusted-publisher check validates — not the shared workflow's.
+# Renaming this file invalidates this package's trusted publisher, and the only symptom is
+# that releases quietly start needing manual approval again.
 name: Publish
 
 on:
@@ -9,69 +14,17 @@ concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
   release:
-    name: Publish Release
-    runs-on: ubuntu-latest
+    uses: linked-fw/.github/.github/workflows/publish.yml@v1
     permissions:
       contents: write
       pull-requests: write
-    steps:
-      # Author the changesets "Version Packages" PR as the org release App (not the default
-      # GITHUB_TOKEN) so its CI runs without a manual "Approve and run" gate. Requires the org
-      # App installed on this repo + org secrets RELEASE_APP_ID / RELEASE_APP_PRIVATE_KEY.
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v2
-        with:
-          app-id: ${{ secrets.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22.16.0
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install dependencies
-        run: npm ci --legacy-peer-deps
-
-      - name: Build
-        run: npm run build
-
-      - name: Create release Pull Request or Publish
-        id: changesets
-        uses: changesets/action@v1
-        with:
-          publish: npx changeset publish
-          title: 'chore: release'
-          commit: 'chore: release'
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
-
-      # When changesets opened/updated the version PR (rather than publishing), merge it so the
-      # release ships without a manual click. App token → the merge's push re-triggers this
-      # workflow, which then runs `changeset publish`. DIRECT-merge (not `--auto`): GitHub
-      # auto-merge ignores branch-protection review-bypass allowances; main is check-only so a
-      # direct merge lands once the required check is green — retry until then.
-      - name: Merge the version PR to publish
-        if: steps.changesets.outputs.hasChangesets == 'true' && steps.changesets.outputs.published != 'true'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          pr=$(gh pr list --base main --head changeset-release/main --state open --json number --jq '.[0].number // empty')
-          if [ -z "$pr" ]; then echo "No open version PR (nothing to merge)."; exit 0; fi
-          for i in $(seq 1 40); do
-            if gh pr merge "$pr" --merge 2>/tmp/merge_err; then
-              echo "Merged version PR #$pr on attempt $i."
-              exit 0
-            fi
-            echo "Attempt $i/40: version PR #$pr not mergeable yet ($(tr -d '\n' < /tmp/merge_err)); waiting for the required check…"
-            sleep 15
-          done
-          echo "::warning::Version PR #$pr not merged after retries — merge it manually."
+      # Needed HERE as well as in the shared workflow: a reusable workflow cannot widen the
+      # permissions its caller was granted, and without this npm never gets an id-token and
+      # every release silently falls back to the approval queue.
+      id-token: write
+    # Named rather than `inherit`: `inherit` forwards everything this repo can see, which is
+    # how a community repo would end up forwarding a first-party token.
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+      RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @\_linked/org
 
+## 1.1.1
+
+### Patch Changes
+
+- [#10](https://github.com/linked-fw/org/pull/10) [`21fbfed`](https://github.com/linked-fw/org/commit/21fbfedb722c8b70697fc645f98e11cd2fd2ff58) Thanks [@flyon](https://github.com/flyon)! - Declare npm as the package manager for this repo, convert the build scripts off `yarn`, and mark `package-lock.json` as a generated file.
+
 ## 1.1.0
 
 ### Minor Changes

package/package.json

@@ -8,9 +8,10 @@
   },
   "repository": {
     "type": "git",
-    "url": ""
+    "url": "git+https://github.com/linked-fw/org.git"
   },
-  "version": "1.1.0",
+  "version": "1.1.1",
+  "packageManager": "npm@11.19.1",
   "linkedPackage": true,
   "type": "module",
   "main": "lib/esm/index.js",
@@ -18,9 +19,9 @@
   "license": "ISC",
   "scripts": {
     "start": "npm exec linked dev",
-    "build": "rimraf ./lib && yarn build-esm && yarn copy-to-lib",
-    "build-esm": "echo \"compiling ESM\" && rimraf ./lib/esm && (yarn tsc -p tsconfig-esm.json || echo 'tsc returned non-zero; .js still emitted via noEmitOnError default')",
-    "copy-to-lib": "echo 'copying JSON assets to lib folder' && yarn copyfiles -u 1 'src/**/*.json' lib/esm"
+    "build": "rimraf ./lib && npm run build-esm && npm run copy-to-lib",
+    "build-esm": "echo \"compiling ESM\" && rimraf ./lib/esm && (tsc -p tsconfig-esm.json || echo 'tsc returned non-zero; .js still emitted via noEmitOnError default')",
+    "copy-to-lib": "echo 'copying JSON assets to lib folder' && copyfiles -u 1 'src/**/*.json' lib/esm"
   },
   "keywords": [
     "lincd",

package/.github/workflows/changeset-check.yml

@@ -1,44 +0,0 @@
-name: Changeset Check
-
-on:
-  pull_request:
-    branches:
-      - main
-
-jobs:
-  changeset-check:
-    name: Check for changeset
-    # Skip the check on the automated Release PR.
-    if: ${{ github.head_ref != 'changeset-release/main' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Check for changeset files
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const { data: files } = await github.rest.pulls.listFiles({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.issue.number,
-            });
-
-            const hasChangeset = files.some(f =>
-              f.filename.startsWith('.changeset/') &&
-              f.filename.endsWith('.md') &&
-              f.filename !== '.changeset/README.md'
-            );
-
-            if (!hasChangeset) {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body: "No changeset found. If this PR should trigger a release, run `npx changeset` and commit the generated file.\n\nIf this change doesn't need a release (docs, CI config, etc.), you can ignore this message."
-              });
-              core.warning('No changeset file found in this PR.');
-            }

package/.github/workflows/ci.yml

@@ -1,43 +0,0 @@
-name: CI
-
-on:
-  pull_request:
-    branches:
-      - main
-
-jobs:
-  build-and-test:
-    name: Build & Test
-    runs-on: ubuntu-latest
-    steps:
-      - name: Detect Release PR
-        id: rpr
-        run: |
-          if [[ "${{ github.event.pull_request.head.ref }}" == "changeset-release/main" ]]; then
-            echo "is_release_pr=true" >> $GITHUB_OUTPUT
-            echo "Release PR from changesets/action detected — skipping build/test (auto-generated version+CHANGELOG only)."
-          else
-            echo "is_release_pr=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Checkout
-        if: steps.rpr.outputs.is_release_pr == 'false'
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        if: steps.rpr.outputs.is_release_pr == 'false'
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22.16.0
-
-      - name: Install dependencies
-        if: steps.rpr.outputs.is_release_pr == 'false'
-        run: npm ci --legacy-peer-deps
-
-      - name: Build
-        if: steps.rpr.outputs.is_release_pr == 'false'
-        run: npm run build
-
-      - name: Test
-        if: steps.rpr.outputs.is_release_pr == 'false'
-        run: npm test --if-present