fix(ci): publish CLI via npm stage like plugins

Merged
RI
2mo ago
+30-6

Summary (AI generated)

  • Replace bun publish + NPM_CONFIG_TOKEN in .github/workflows/publish_cli.yml with npm stage publish + NODE_AUTH_TOKEN, matching the Cap-go/capacitor-updater .github/workflows/build.yml deploy job pattern.
  • Add npm CLI v11.15+ install, staged publish steps (from cli/ with --provenance --ignore-scripts), and the npm-stage-approve automation dispatch.
  • Keep existing bun install/build, CAPGO_KEYCHAIN_HELPER_PATH leak check, AI changelog, and GitHub release steps unchanged.

Motivation (AI generated)

Tags cli-8.39.1 through cli-8.41.1 failed on the "Publish CLI to npm" step. The workflow used NPM_CONFIG_TOKEN with bun publish --cwd cli, but Bun in CI does not pick up that token reliably and falls back to interactive browser login, which times out. The last successful npm publish was @capgo/cli@8.39.0.

Business Impact (AI generated)

  • Unblocks CLI npm releases so customers (including SuperFrete) can install current versions via npx @capgo/cli@latest.
  • Aligns CLI publishing with the proven plugin staged-publish flow already used in capacitor-updater.

Test Plan (AI generated)

  • Merge this PR.
  • Retag and push cli-8.41.1 (SuperFrete needs this version on npm).
  • Confirm the workflow completes: npm stage publish succeeds, stage approval dispatch fires, and @capgo/cli@8.41.1 appears on npm with provenance.

Generated with AI

Open in Web Open in Cursor 

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

Summary by CodeRabbit

  • Chores
    • Improved the package release process for more reliable publishing.
    • Stable releases are now clearly labeled for standard installs, while alpha releases use a separate preview channel.
    • Added an approval step before publishing staged releases, helping ensure updates are reviewed before becoming available.