@meddleware/token-deployer-ui 0.0.5 → 0.0.6

package/.github/workflows/{publish.yml → docker-publish.yml}

@@ -1,5 +1,4 @@
-name: Publish
-
+name: Publish (Docker)
 on:
   push:
     tags:
@@ -9,48 +8,27 @@ env:
   IMAGE: token-deployer-ui
 
 jobs:
-  # ── Library source: @meddleware/token-deployer-ui → npmjs ──────────────────
-  # Uses OIDC trusted publisher — no static NPM_TOKEN secret required.
-  publish-npm:
-    name: npmjs (@meddleware/token-deployer-ui)
+  verify:
+    name: Verify (type-check + test)
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
     steps:
       - uses: actions/checkout@v7.0.1
-
       - uses: actions/setup-node@v7.0.0
         with:
           node-version: '24'
-          registry-url: 'https://registry.npmjs.org'
-
       - name: Install dependencies
         run: npm ci
-
+      - name: Audit dependencies
+        run: npm audit --audit-level=high
       - name: Type-check
-        run: npm run type-check
-
-      - name: Test
-        run: npm test
-
-      - name: Publish to npmjs (provenance via OIDC, idempotent)
-        run: |
-          VERSION=$(node -p "require('./package.json').version")
-          if npm view "@meddleware/token-deployer-ui@${VERSION}" version >/dev/null 2>&1; then
-            echo "::notice::v${VERSION} already published to npmjs — skipping"
-          else
-            npm publish --provenance
-          fi
-
-  # ── App: Docker image → quay.io + Docker Hub ────────────────────────────────
-  # Split into per-arch native builds + merge so each platform compiles on its
-  # own native runner. The arm64 Vite build runs on ubuntu-24.04-arm rather than
-  # QEMU emulation, eliminating the ~3-5× slowdown for npm install + tsc + vite.
+        run: npm run type-check --if-present
+      - name: Unit tests
+        run: npm run test --if-present
 
   build-docker-amd64-public:
     name: Docker amd64 (quay.io + Docker Hub)
     runs-on: ubuntu-latest
+    needs: verify
     permissions:
       contents: read
     steps:
@@ -103,6 +81,7 @@ jobs:
   build-docker-arm64-public:
     name: Docker arm64 (quay.io + Docker Hub)
     runs-on: ubuntu-24.04-arm
+    needs: verify
     permissions:
       contents: read
     steps:
@@ -252,6 +231,7 @@ jobs:
   build-docker-amd64-private:
     name: Docker amd64 (self-hosted registry)
     runs-on: ubuntu-latest
+    needs: verify
     continue-on-error: true
     permissions:
       contents: read
@@ -290,6 +270,7 @@ jobs:
   build-docker-arm64-private:
     name: Docker arm64 (self-hosted registry)
     runs-on: ubuntu-24.04-arm
+    needs: verify
     continue-on-error: true
     permissions:
       contents: read

package/.github/workflows/{ci.yml → node-ci.yml}

@@ -1,4 +1,4 @@
-name: CI
+name: Node CI
 
 on:
   push:

package/.github/workflows/npm-publish.yml

@@ -0,0 +1,68 @@
+name: Publish (npm)
+
+# Publishes the app's library entry (@meddleware/token-deployer-ui) to npmjs on a v* tag, so it can be
+# embedded by the dashboard. npm is a SECONDARY output here (the app also ships a
+# container image via docker-publish.yml), so publication is opt-in via the
+# repository variable NPM_PUBLISH and gated on a self-contained `verify` job.
+# Authentication uses npm OIDC trusted publishing — no long-lived NPM_TOKEN.
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Verify (type-check + test)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - uses: actions/setup-node@v7.0.0
+        with:
+          node-version: '24'
+      - name: Install dependencies
+        run: npm ci
+      - name: Audit dependencies
+        run: npm audit --audit-level=high
+      - name: Type-check
+        run: npm run type-check --if-present
+      - name: Unit tests
+        run: npm run test --if-present
+
+  publish-npm:
+    name: npmjs (@meddleware/token-deployer-ui)
+    needs: verify
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # required for OIDC trusted publishing
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - uses: actions/setup-node@v7.0.0
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+      # Trusted publishing (OIDC) requires npm >= 11.5.1; Node 24 ships an older npm.
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@latest
+      - name: Install dependencies
+        run: npm ci
+      - name: Build
+        run: npm run build --if-present
+      - name: Publish to npmjs (OIDC, idempotent, opt-in)
+        env:
+          NPM_PUBLISH: ${{ vars.NPM_PUBLISH }}
+        run: |
+          if [ "${NPM_PUBLISH}" != "true" ]; then
+            echo "::warning::npm publishing not configured — set repository variable NPM_PUBLISH=true and configure an npmjs trusted publisher to enable it. Skipping npm publication."
+            exit 0
+          fi
+          VERSION=$(node -p "require('./package.json').version")
+          if npm view "@meddleware/token-deployer-ui@${VERSION}" version >/dev/null 2>&1; then
+            echo "::notice::v${VERSION} already published to npmjs — skipping."
+          else
+            npm publish
+          fi

package/package.json

@@ -1,11 +1,15 @@
 {
   "name": "@meddleware/token-deployer-ui",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "type": "module",
   "exports": {
-    ".": { "default": "./src/index.ts" }
+    ".": {
+      "default": "./src/index.ts"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
   },
-  "publishConfig": { "access": "public" },
   "scripts": {
     "dev": "vite",
     "build": "vue-tsc --noEmit && vite build",
@@ -30,10 +34,10 @@
     "verify:template": "node scripts/verify-bytecode.mjs && vitest run tests/templateArtifact.test.ts tests/templateParity.test.ts"
   },
   "dependencies": {
-    "@meddleware/design-tokens": "^0.1.5",
-    "@meddleware/ui": "^0.1.24",
-    "@meddleware/wallet-adapter": "^0.0.7",
-    "@meddleware/walrus-relay": "^0.1.16",
+    "@meddleware/design-tokens": "^0.1.6",
+    "@meddleware/ui": "^0.1.26",
+    "@meddleware/wallet-adapter": "^0.0.8",
+    "@meddleware/walrus-relay": "^0.1.17",
     "@mysten/bcs": "~2.1.0",
     "@mysten/move-bytecode-template": "~0.4.0",
     "@mysten/sui": "^2.31.0",
@@ -42,10 +46,10 @@
     "vue": "^3.5.0"
   },
   "devDependencies": {
+    "@playwright/test": "^1.56.0",
     "@types/node": "~24.12.2",
     "@vitejs/plugin-vue": "^6.0.8",
     "@vitejs/plugin-vue-jsx": "^5.1.6",
-    "@playwright/test": "^1.56.0",
     "@vitest/eslint-plugin": "^1.6.23",
     "@vue/test-utils": "^2.4.0",
     "jsdom": "^29.1.1",