Publishing Packages

Every published package under packages/** has a .release-it.json. A release bumps the version, commits, tags as <package>@<version>, pushes, creates the GitHub release and publishes to npm. @frigear-nu/base is published as source (a Nuxt layer has no build step, so its release-it config has no after:bump hook). @frigear-nu/eslint-config is published as plain ESM source too. @frigear-nu/cli is private and not published.

Requirements

• Node.js and pnpm as in Local development.
• Push access to the repository, and a clean working tree (requireCleanWorkingDir is on).
• A package that is registered for npm Trusted Publishing (see Trusted publishing).

Release a package

Run from the repository root:

pnpm install
cd packages/<your-package>
pnpm exec release-it <patch|minor|major|premajor|preminor|prepatch|prerelease>

The package's release-it config builds after the bump (after:bump) and then runs scripts/npm-publish.sh once the GitHub release exists (after:release).

If the release fails because of authentication, the version commit and tag are already pushed. Resume only the npm publish:

bash ../../scripts/npm-publish.sh

The packages also have a release npm script (changelogen and npm publish) left over from the module starter. This guide uses release-it instead.

Release from GitHub Actions

The Release workflow (.github/workflows/release.yml) does the same from the Actions tab. It takes two inputs:

The jobs run in this order:

1. verify builds the package's workspace dependencies and runs its tests, one runner per package, in parallel. Nothing is pushed or published.
2. release versions the packages that passed one at a time (each pushes a commit and tag to the branch), using scripts/release-package.sh with release-it's hooks off. It then builds them once and publishes them to npm up to four at a time (scripts/publish-released.sh).

A failing package does not stop the others but fails the run. If a version was tagged but never reached npm, running the workflow again publishes it without cutting a new version. Only one release runs at a time.

Trusted publishing

Publishing uses npm Trusted Publishing (OIDC), so no npm token is stored. The workflow's release job has id-token: write to mint the token. Each package must have the repository and the release.yml workflow registered as a trusted publisher on npmjs.com.

scripts/npm-publish.sh packs the package with pnpm pack, so workspace:* dependencies become real version ranges, then publishes the tarball with npm publish --provenance --access public. It uses the npm CLI because pnpm does not implement Trusted Publishing yet, and --provenance is needed because npm's token exchange otherwise fails for scoped monorepo packages.

Add a new package

1. Give it a .release-it.json: copy a sibling's and change the package name and tag.
2. Add it to the package choices and to the all list in the prepare job of release.yml. Keep the two in sync.
3. Register it as a trusted publisher on npmjs.com.