Skip to content

ci: publish plugins to the EmDash registry after npm - #18

Merged
danielmlr merged 1 commit into
mainfrom
ci/emdash-registry-release
Sep 28, 2026
Merged

danielmlr merged 1 commit into
mainfrom
ci/emdash-registry-release

Conversation

@danielmlr

@danielmlr danielmlr commented Sep 27, 2026 •

Copy link
Copy Markdown
Member

Publishes each npm release of a plugin to the EmDash registry as well. The first registry release will be analytics 0.2.1, when #17 is merged.

emdash-release.yml is generated by emdash-plugin release setup (plugin-cli 0.12.0, Changesets trigger), and release.yml calls it after the npm publish job. The package profile @eisbachcode.de/analytics and the publishing grant on releases.emdashcms.com already exist.

Changes to the generated workflow

  • pnpm version: the generated version: 11 input is removed. pnpm/action-setup v4 aborts when that value is not exactly the packageManager value from package.json (pnpm@11.15.1). Without the input, the action reads packageManager.
  • Build and publish split: build and publish run in separate jobs. The build job hands the bundle over as an artifact; the publish job downloads it, attests it and runs the EmDash release action.
  • Unpinned action: emdash-cms/emdash/apps/release-action@main stays unpinned, as generated. EmDash runs the release service that action talks to.

Other changes

  • release.yml: the npm publish job gets environment: npm, so the trusted publisher on npmjs.com can require it. The publish job also exposes published and published-packages for the caller job.
  • analytics manifest: the description is shortened from 202 to 136 characters, because the registry profile allows at most 140. emdash-plugin validate accepts up to 1,024, so the failure only showed at release setup.
  • analytics screenshots/ becomes images/. The registry bundle includes a screenshots/ folder whole. That took the bundle to 1,016 KB against a 256 KB limit, and two images were over the 128 KB per-file limit. Images in images/ are uploaded as the listing images declared in the manifest. The README links move with them.
  • AGENTS.md now documents the registry step, the token rule and both registry limits.

Verified

  • emdash-plugin release plan locally with a published-packages list containing analytics and shared: selects only analytics@0.2.0.
  • emdash-plugin release prepare analytics@0.2.0 --out-dir .emdash-release: a 37.8 KB bundle containing README.md, backend.js and manifest.json, with the publisher DID from the manifest.
  • The profile rebuilt from the manifest the way plugin-cli builds it passes the registry lexicon (PackageProfile).
  • actionlint passes on both workflows. emdash-plugin validate, build and typecheck pass for analytics.
  • Not verified: the split workflow against the release service. That happens on the first real run. Its job summary shows a repository-connection approval link, which only the publisher can confirm.

After merging

  1. On npmjs.com, set the trusted publisher of @eisbachcode/emdash-plugin-analytics to require the npm environment.
  2. Merge this PR before chore: version packages #17. The published 0.2.0 README links screenshots/ on main, so its images break until 0.2.1 is out.

@changeset-bot

changeset-bot Bot commented Sep 27, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 4e30da7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@eisbachcode/emdash-plugin-analytics Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

emdash-release.yml comes from `emdash-plugin release setup` (plugin-cli
0.12.0, Changesets trigger) and runs after the npm publish job with the
packages Changesets published. Two changes to the generated file:

- pnpm/action-setup v4 aborts when its `version: 11` differs from
  package.json's `packageManager` (pnpm@11.15.1), so the input is gone
  and the action reads packageManager.
- Build and publish run in separate jobs. The build job hands the bundle
  over as an artifact; the publish job only downloads it, attests it and
  runs the release action.

The npm publish job gets the `npm` environment, so the trusted publisher
on npmjs.com can require it.

analytics: the registry refuses a profile description over 140
graphemes (ours had 202) and bundles a `screenshots/` folder whole, which
took the bundle to 1,016 KB against a 256 KB limit. The description is
shorter and the listing images move to `images/`, where they are
uploaded as declared artifacts instead.
@danielmlr
danielmlr force-pushed the ci/emdash-registry-release branch from c9df6bd to 4e30da7 Compare September 27, 2026 21:13
@danielmlr
danielmlr merged commit 0accf03 into main Sep 28, 2026
2 checks passed
@danielmlr
danielmlr deleted the ci/emdash-registry-release branch September 28, 2026 10:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant