@hardfin/cli 0.1.1-dev.46 → 0.1.1-dev.48

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +19 -0
  2. package/package.json +1 -1
package/README.md CHANGED
@@ -641,6 +641,25 @@ report's stack trace then reads as the TypeScript source. The maps are not in th
641
641
  publishing skips `prepublishOnly`, so the stamped files are the ones published. The upload
642
642
  needs the `SENTRY_AUTH_TOKEN` secret.
643
643
 
644
+ ### How the workflow is kept from publishing the wrong thing
645
+
646
+ The workflow runs as two jobs, so nothing that installs or runs a dependency can publish.
647
+
648
+ | Job | Does | May |
649
+ | --------- | --------------------------------------------------------------- | ---------------------------------- |
650
+ | `build` | Installs, builds, stamps the files, and packs one `.tgz` | Read the repository |
651
+ | `publish` | Takes that one file, publishes it, and opens the GitHub release | Publish to npm, and write releases |
652
+
653
+ - Every action is pinned to a commit, with its version in a comment beside it
654
+ - `npm ci` runs with `--ignore-scripts`, in every workflow
655
+ - The version of npm that publishes is named, and raised on purpose
656
+ - The version in `package.json` must be plain semver before it reaches a shell
657
+ - A run started by hand from any branch but `main` or `dev` stops before it builds
658
+ - A GitHub release is tagged at the commit that was published
659
+
660
+ To raise an action, change the commit and the comment together. `gh api
661
+ repos/actions/checkout/commits/v5 -q .sha` prints the commit a tag names.
662
+
644
663
  ### Cut a release
645
664
 
646
665
  1. Open a pull request against `dev` that sets `version` in `package.json` to the version
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@hardfin/cli",
3
- "version": "0.1.1-dev.46",
3
+ "version": "0.1.1-dev.48",
4
4
  "description": "Command line interface for the Hardfin API",
5
5
  "license": "Apache-2.0",
6
6
  "author": "Hardfin, Inc.",