@voxgig/sdkgen 3.2.0 → 3.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voxgig/sdkgen",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "main": "dist/sdkgen.js",
   "type": "commonjs",
   "engines": {

package/project/.sdk/src/cmp/seneca-provider/Extras_seneca-provider.ts

@@ -623,15 +623,18 @@ describe('${provider.fileBase}', () => {
       // Repository hygiene, from the @seneca/maintain dependency this package
       // declares. Two of its checks report a fault that is not there, because
       // of WHERE they run rather than what they find, so each is excluded
-      // only in the environment that breaks it.
+      // only in the environments that break it.
       Content(`
   it('maintain', async () => {
     const exclude = []
 
     // check_default proves the default branch is main by looking for
-    // [branch "main"] in .git/config. A pull_request build checks out the
-    // merge ref, which records no such section.
-    if ('pull_request' === process.env.GITHUB_EVENT_NAME) {
+    // [branch "main"] in .git/config. Only a branch checkout records that
+    // section: a pull_request build checks out the merge ref, and the
+    // publish build checks out a tag as a detached HEAD. Neither says
+    // anything about what the default branch is, so skip rather than fail.
+    if ('pull_request' === process.env.GITHUB_EVENT_NAME ||
+        'tag' === process.env.GITHUB_REF_TYPE) {
       exclude.push('check_default')
     }
 
@@ -1026,6 +1029,102 @@ ${!provider.liveApp ? '' : `
       - run: npm i seneca seneca-entity seneca-promisify @seneca/provider @seneca/env
       - run: npm run build --if-present
       - run: npm test
+`)
+      })
+
+      // --- publish.yml ---------------------------------------------------
+      //
+      // Release on a `v*` tag push, via GitHub OIDC Trusted Publishing — no
+      // NPM_TOKEN secret anywhere. `id-token: write` lets npm exchange a
+      // GitHub OIDC token for a short-lived publish credential, and npm
+      // attaches provenance automatically.
+      //
+      // TWO THINGS ARE LOAD-BEARING AND EASY TO GET WRONG.
+      //
+      // The FILENAME. npm's trusted publisher is registered against this
+      // file's name, so renaming it breaks publishing until the npm-side
+      // configuration is changed to match. It is publish.yml deliberately.
+      //
+      // `npm install`, NOT `npm ci`. A Seneca plugin does not commit its
+      // lockfile (see .gitignore), so there is nothing for ci to install
+      // from — it fails outright. The SDK repo commits one and uses ci; this
+      // package cannot.
+      //
+      // The host framework is installed explicitly for the same reason
+      // build.yml does it: seneca and its plugins are PEER dependencies, and
+      // the test suite requires them directly.
+      File({ name: 'publish.yml' }, () => {
+        Content(`# Generated by @voxgig/sdkgen. Do not edit.
+#
+# Publishes ${provider.pkgName} to npm on a \`v*\` tag push, via GitHub OIDC
+# Trusted Publishing — no NPM_TOKEN secret. The \`id-token: write\` permission
+# lets npm exchange a GitHub OIDC token for a short-lived publish credential,
+# and provenance is attached automatically.
+#
+# The trusted publisher must be registered on npmjs.com for this package
+# against THIS filename (publish.yml); renaming this file breaks publishing
+# until the npm-side config is updated to match.
+#
+# npm cannot publish a package's FIRST version this way — the settings page
+# that configures a trusted publisher only exists once a version is there. So
+# release ${provider.version} by hand once, configure the publisher, and every
+# release after that is a tag push.
+#
+# Release flow: bump the version in the SDK model
+# (\`main: kit: target: 'seneca-provider': publish: version\`), regenerate,
+# merge, then push a v* tag.
+
+name: publish
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+jobs:
+  publish:
+    name: npm publish
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24.x
+          registry-url: 'https://registry.npmjs.org'
+
+      # Trusted publishing requires npm >= 11.5.1.
+      - name: Use a trusted-publishing capable npm
+        run: npm install -g npm@latest
+
+      # install, not ci: this package does not commit a lockfile.
+      - run: npm install
+
+      # The Seneca host framework is a PEER dependency, so the test suite
+      # needs it installed explicitly.
+      - run: npm i seneca seneca-entity seneca-promisify @seneca/provider @seneca/env
+
+      - run: npm run build
+      - run: npm test
+
+      # The tag must match what the manifest declares, or a tag push silently
+      # republishes whatever version happens to be in package.json.
+      - name: Check the tag matches the manifest version
+        run: |
+          TAG="\${GITHUB_REF_NAME#v}"
+          PKG=$(node -p "require('./package.json').version")
+          if [ "$TAG" != "$PKG" ]; then
+            echo "tag v$TAG does not match package.json $PKG"
+            exit 1
+          fi
+
+      - name: Publish to npm
+        run: npm publish --access public
 `)
       })
     })