feat(publish): release via App token, publish to PyPI and public npm - #14
Open
ciaransweet wants to merge 1 commit into
Open
feat(publish): release via App token, publish to PyPI and public npm#14ciaransweet wants to merge 1 commit into
ciaransweet wants to merge 1 commit into
Conversation
Publishing now hangs off an `on: release` workflow instead of being inlined in the release-please job. That only works because release-please authenticates as the DS release bot rather than GITHUB_TOKEN — GitHub suppresses workflow events for anything GITHUB_TOKEN does, so the release it used to create never triggered anything. The workflow's filename and environment are load-bearing: PyPI's registered trusted publisher names `publish.yaml` / `release`, so the file moves off .yml and the environment off `pypi`. Drops publish-pypi.yml, an `if: false` placeholder for exactly this. Moves @developmentseed/mcp-view from GitHub Packages to public npm, also via OIDC trusted publishing. Consuming UIs no longer need an .npmrc or a GITHUB_TOKEN with read:packages, so the scaffold stops writing one and CONSUMING.md drops the registry setup. Node 22 ships npm 10, so the job upgrades npm — trusted publishing needs >= 11.5.1. Also corrects uv.lock, which still recorded 0.1.0 against a 0.1.2 pyproject. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kylebarron
reviewed
Jul 29, 2026
Member
There was a problem hiding this comment.
I generally like to split publishing to pypi and to npm in case only one of them fails to publish, and I only want to trigger one of them to restart.
Though I suppose having them in one yaml doesn't actually prevent that workflow?
Member
There was a problem hiding this comment.
Yeah, I think these will run in parallel
alukach
approved these changes
Jul 29, 2026
Member
There was a problem hiding this comment.
Yeah, I think these will run in parallel
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishing moves out of the release-please job and into an
on: releaseworkflow.That only works because release-please now authenticates as the DS release bot rather than
GITHUB_TOKEN— GitHub suppresses workflow events for anythingGITHUB_TOKENdoes, so the release it used to create never triggered anything, which is why npm publishing had to be inlined.PyPI
Trusted publishing via OIDC. The workflow's filename and environment are load-bearing: the registered pending publisher names
publish.yaml/release, so the file moves off.ymland the environment offpypi. Changing either here without changing it on PyPI first fails with an OIDC claim mismatch.Drops
publish-pypi.yml, anif: falseplaceholder for exactly this.npm
@developmentseed/mcp-viewmoves from GitHub Packages to public npm, also via trusted publishing. Consuming UIs no longer need an.npmrcor aGITHUB_TOKENwithread:packages, so:ui/.npmrcdocs/CONSUMING.md§3b drops the registry setuppackage.jsongains"access": "public"— scoped packages default to restricted on npmjs and the first publish fails without itThe
npm install -g npm@lateststep is load-bearing, not defensive: Node 22 ships npm 10 and trusted publishing needs >= 11.5.1.🤖 Generated with Claude Code