ci: publish to npm via trusted publishing (fixes failing publishes since 2026-10-13)

Merged
SW
17d ago
+30-13

Part of recoupable/app#2365. Every merge to main publishes @recoupable/cli to npm via OIDC trusted publishing. No NPM_TOKEN and no personal login.

Why

Publish to npm has failed on every merge since 2026-10-13 with npm error 404 Not Found - PUT https://registry.npmjs.org/@recoupable%2fcli. That points to NPM_TOKEN no longer being able to publish. npm is still on 0.1.15, so #26, #27 and #28 never shipped. Each failed run had also already pushed its version bump, leaving main at 0.1.18 with three versions that were never published.

What changed

  • permissions: id-token: write, Node 24, and npm ^11.5.1, which trusted publishing requires. The step is now npm publish with no NODE_AUTH_TOKEN. Provenance is attached automatically.
  • The version bump happens in the working tree first, and is committed and pushed only after typecheck → build → test → publish succeed. A failed run leaves main unchanged.
  • package.json gains repository.url, which trusted publishing requires to match github.com/recoupable/cli.

Before merging (owner action)

On npmjs.com → @recoupable/cli → Settings → Trusted publishing, add GitHub Actions: org recoupable, repo cli, workflow publish.yml. The merge itself is the first publish (0.1.19, containing #26–28), so this must be configured first or the run fails at the publish step. Because the bump now commits only after a successful publish, that failure would leave main unchanged.

Verified locally

  • tsc --noEmit and pnpm build pass. npm pack --dry-run packs README.md, dist/bin.cjs and package.json.
  • pnpm test: 81/83 passed in the full local run. The 2 failures were 5 s timeouts in publishedCommands.test.ts while the machine was under load. That file passes 6/6 when run alone, and it is unchanged by this PR.
  • The workflow itself can only be verified by the post-merge run. Done-when, from app#2365: npm view @recoupable/cli version → 0.1.19 with a provenance badge, and the bump commit lands after the publish step.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores
    • Updated the package release process and repository information. These changes affect how new versions are published, with no changes to the CLI’s functionality.