httpcat-cli 0.0.27 → 0.1.0

package/.github/workflows/README.md

@@ -11,9 +11,23 @@ Continuous Integration workflow that runs on every push and pull request:
 - Security audits
 - Code coverage reporting
 
+### `publish-switch.yml`
+Entry point workflow for npm trusted publishing (OIDC). This is the workflow that npm validates against.
+- Routes to either `rc-publish.yml` (for develop branch) or `release.yml` (for main branch/tags)
+- Contains OIDC permissions required for trusted publishing
+- This is the workflow file that must be configured in npm's Trusted Publishers settings
+
+### `rc-publish.yml`
+Reusable workflow for publishing Release Candidate versions:
+- Called by `publish-switch.yml` when pushing to `develop` branch
+- Automatically increments RC version number
+- Publishes to npm with `rc` tag
+- Does not create GitHub releases
+
 ### `release.yml`
-Automated release workflow that:
-- Triggers on version tags (v*.*.*) or manual dispatch
+Reusable workflow for publishing official releases:
+- Called by `publish-switch.yml` when pushing to `main` branch or version tags
+- Auto-detects version bump from conventional commits (BREAKING/feat/fix)
 - Validates version format
 - Runs tests and builds
 - Publishes to npm
@@ -25,9 +39,28 @@ Manual workflow to update the Homebrew formula in the tap repository.
 
 ## Secrets Required
 
-Configure these in Repository Settings → Secrets and variables → Actions:
+**No secrets needed for publishing!** We use npm's [trusted publishing](https://docs.npmjs.com/trusted-publishers) with OIDC.
+
+### Setting up Trusted Publishing
+
+1. Go to your package settings: https://www.npmjs.com/package/httpcat-cli/settings
+2. Navigate to **"Trusted Publishers"** section
+3. Click **"Add Trusted Publisher"**
+4. Select **"GitHub Actions"**
+5. Configure:
+   - **Repository**: `hathbanger/httpcat-cli`
+   - **Workflow file**: `.github/workflows/publish-switch.yml` (this is the entry point that routes to RC or release)
+   - **Environment name**: `npm-publish` (optional, if using environments)
+6. Save the configuration
+
+**Important:** Only `publish-switch.yml` needs to be configured as the trusted publisher. It will automatically route to the correct workflow (RC or release) based on the trigger.
 
-- `NPM_TOKEN`: npm authentication token with publish permissions
+**Benefits:**
+- ✅ No tokens needed - uses OIDC authentication
+- ✅ Bypasses 2FA requirements automatically
+- ✅ Automatic provenance generation
+- ✅ More secure - short-lived credentials
+- ✅ No token management or rotation needed
   - Generate at: https://www.npmjs.com/settings/YOUR_USERNAME/tokens
   - Required scopes: `read:packages`, `write:packages`
 

package/.github/workflows/ci.yml

@@ -7,7 +7,7 @@ on:
     branches: [main, develop]
 
 env:
-  NODE_VERSION: '20'
+  NODE_VERSION: "20"
 
 jobs:
   test:
@@ -15,29 +15,33 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: ['18', '20', '22']
+        node-version: ["18", "20", "22"]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: latest
 
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-          cache: 'yarn'
 
       - name: Install dependencies
-        run: yarn install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Run tests
-        run: yarn test
+        run: bun run test
 
       - name: Build
-        run: yarn build
+        run: bun run build
 
       - name: Upload coverage reports
         if: matrix.node-version == '20'
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
           files: ./coverage/lcov.info
           flags: unittests
@@ -49,19 +53,23 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: latest
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: 'yarn'
 
       - name: Install dependencies
-        run: yarn install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Type check
-        run: yarn build --noEmit || npx tsc --noEmit
+        run: bun run build --noEmit || npx tsc --noEmit
 
       - name: Check formatting (if configured)
         continue-on-error: true
@@ -77,19 +85,23 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: latest
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: 'yarn'
 
       - name: Install dependencies
-        run: yarn install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Run security audit
-        run: yarn audit --level moderate || true
+        run: bun audit --audit-level moderate || true
 
       - name: Check for known vulnerabilities
         uses: snyk/actions/node@master
@@ -98,4 +110,3 @@ jobs:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
           args: --severity-threshold=high
-

package/.github/workflows/homebrew-tap.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout homebrew tap
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: hathbanger/homebrew-httpcat
           token: ${{ secrets.GITHUB_TOKEN }}

package/.github/workflows/publish-switch.yml

@@ -0,0 +1,41 @@
+name: Publish Switch
+
+# This is the entry point workflow that npm will trust for OIDC publishing
+# It conditionally calls either the RC or Release workflow based on the trigger
+
+on:
+  push:
+    branches:
+      - develop # RC publishing
+      - main # Release publishing
+    tags:
+      - "v*.*.*" # Release publishing via tags
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to release (e.g., 1.2.3). Leave empty for auto-detection from commits."
+        required: false
+        type: string
+
+permissions:
+  id-token: write # Required for OIDC to request ID token to authenticate workflow
+  contents: write # Required for creating tags and releases
+
+jobs:
+  publish-rc:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+    uses: ./.github/workflows/rc-publish.yml
+    permissions:
+      id-token: write
+      contents: read
+
+  publish-release:
+    if: |
+      (github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))) ||
+      github.event_name == 'workflow_dispatch'
+    uses: ./.github/workflows/release.yml
+    with:
+      version: ${{ github.event.inputs.version }}
+    permissions:
+      id-token: write
+      contents: write

package/.github/workflows/rc-publish.yml

@@ -0,0 +1,196 @@
+name: RC Publish
+
+# This is a reusable workflow called by publish-switch.yml
+on:
+  workflow_call:
+    # No inputs needed for RC publishing
+
+env:
+  NODE_VERSION: "20"
+  REGISTRY_URL: "https://registry.npmjs.org"
+
+jobs:
+  # Job 1: Determine RC version
+  prepare:
+    name: Prepare RC Version
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      base-version: ${{ steps.version.outputs.base-version }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          registry-url: ${{ env.REGISTRY_URL }}
+
+      - name: Get base version from package.json
+        id: base-version
+        run: |
+          BASE_VERSION=$(node -p "require('./package.json').version")
+          # Remove any existing prerelease suffix (e.g., 0.0.28-rc.1 -> 0.0.28)
+          BASE_VERSION=$(echo "$BASE_VERSION" | sed 's/-.*$//')
+          echo "base-version=$BASE_VERSION" >> $GITHUB_OUTPUT
+          echo "✅ Base version: $BASE_VERSION"
+
+      - name: Find latest RC version and increment
+        id: version
+        run: |
+          BASE_VERSION="${{ steps.base-version.outputs.base-version }}"
+
+          echo "Querying npm for existing RC versions..."
+          # Get all versions from npm
+          ALL_VERSIONS=$(npm view httpcat-cli versions --json 2>/dev/null || echo "[]")
+
+          # Filter for versions matching base version with RC suffix
+          RC_VERSIONS=$(echo "$ALL_VERSIONS" | node -e "
+            const versions = JSON.parse(require('fs').readFileSync(0, 'utf-8'));
+            const base = process.argv[1];
+            const rcVersions = versions
+              .filter(v => v.startsWith(base + '-rc.'))
+              .map(v => {
+                const match = v.match(/-rc\.(\d+)$/);
+                return match ? parseInt(match[1]) : 0;
+              })
+              .filter(n => n > 0)
+              .sort((a, b) => b - a);
+            console.log(rcVersions.length > 0 ? rcVersions[0] : 0);
+          " "$BASE_VERSION")
+
+          # Increment RC number
+          NEXT_RC=$((RC_VERSIONS + 1))
+          RC_VERSION="${BASE_VERSION}-rc.${NEXT_RC}"
+
+          echo "version=$RC_VERSION" >> $GITHUB_OUTPUT
+          echo "✅ Next RC version: $RC_VERSION"
+
+  # Job 2: Build and test
+  test:
+    name: Build & Test
+    runs-on: ubuntu-latest
+    needs: prepare
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: latest
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Run tests
+        run: bun run test
+        # Note: Using Vitest now instead of Jest
+
+      - name: Build
+        run: bun run build
+
+      - name: Verify build output
+        run: |
+          if [ ! -f "dist/index.js" ]; then
+            echo "❌ Build failed: dist/index.js not found"
+            exit 1
+          fi
+          echo "✅ Build successful"
+
+  # Job 3: Publish RC to npm
+  publish-npm:
+    name: Publish RC to npm
+    runs-on: ubuntu-latest
+    needs: [prepare, test]
+    environment:
+      name: npm-publish
+      url: https://www.npmjs.com/package/httpcat-cli
+    permissions:
+      contents: read
+      id-token: write # Required for OIDC trusted publishing (no token needed!)
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          registry-url: ${{ env.REGISTRY_URL }}
+
+      - name: Update npm to latest
+        run: npm install -g npm@latest
+        # npm 11.5.1+ required for trusted publishing (OIDC)
+
+      - name: Update package.json version
+        run: |
+          npm version "${{ needs.prepare.outputs.version }}" --no-git-tag-version --allow-same-version
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Build
+        run: bun run build
+
+      - name: Publish RC to npm
+        run: npm publish --tag rc --access public
+        # Uses trusted publishing (OIDC) - no token needed!
+        # Configure trusted publisher at: https://www.npmjs.com/package/httpcat-cli/settings
+        # Provenance is automatically generated when using trusted publishing
+
+      - name: Verify npm publication
+        run: |
+          VERSION="${{ needs.prepare.outputs.version }}"
+          MAX_ATTEMPTS=10
+          INITIAL_WAIT=5
+          ATTEMPT=1
+
+          echo "Waiting for npm CDN propagation for httpcat-cli@$VERSION..."
+
+          while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
+            # Exponential backoff: 5s, 10s, 20s, 40s, etc. (capped at 60s)
+            WAIT_TIME=$((INITIAL_WAIT * (2 ** (ATTEMPT - 1))))
+            if [ $WAIT_TIME -gt 60 ]; then
+              WAIT_TIME=60
+            fi
+            
+            if [ $ATTEMPT -gt 1 ]; then
+              echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Waiting ${WAIT_TIME}s before retry..."
+              sleep $WAIT_TIME
+            else
+              echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Initial wait ${WAIT_TIME}s..."
+              sleep $WAIT_TIME
+            fi
+            
+            if npm view httpcat-cli@$VERSION version > /dev/null 2>&1; then
+              echo "✅ Successfully verified httpcat-cli@$VERSION is available on npm (rc tag)"
+              exit 0
+            else
+              echo "⚠️  Package not yet available on npm CDN (attempt $ATTEMPT/$MAX_ATTEMPTS)"
+            fi
+            
+            ATTEMPT=$((ATTEMPT + 1))
+          done
+
+          echo "❌ Failed to verify npm publication after $MAX_ATTEMPTS attempts"
+          echo "Package may still be propagating. Check manually: npm view httpcat-cli@$VERSION"
+          exit 1
+
+      - name: RC summary
+        run: |
+          echo "✅ RC published successfully!"
+          echo "Version: ${{ needs.prepare.outputs.version }}"
+          echo "npm: https://www.npmjs.com/package/httpcat-cli/v/${{ needs.prepare.outputs.version }}"
+          echo "Install: npm install -g httpcat-cli@${{ needs.prepare.outputs.version }}"