Add release workflows and update package metadata#9
Merged
Conversation
- build-binaries.yml: builds pcf-debug and pfs for linux x86_64/aarch64, macOS universal2 (lipo), windows x86_64/aarch64; uploads tar.gz/zip artifacts with SHA256 on every push/PR. Reusable via workflow_call. - release.yml: on tag v*, publishes pcf/pfs-ms/pcf-debug to crates.io, @kduma-oss/pcf to npm, KDuma.Pcf to NuGet, splits implementations/php to kduma-OSS-splits/PHP-PCF-lib (Packagist source), and attaches binaries + SHA256SUMS to a GitHub Release. workflow_dispatch supports dry-run mode. - php-split.yml: keeps the PHP split repo's master branch in sync on every push to implementations/php (so Packagist dev-master tracks monorepo). Package metadata updated for publication: - Cargo.toml (pcf, pfs-ms, pcf-debug): real repository/homepage URLs, keywords, categories; path deps pinned with version for crates.io. - package.json: name -> @kduma-oss/pcf, repository/bugs/homepage, publishConfig.access=public. - composer.json: name -> kduma/pcf (vendor change), homepage/support. - Pcf.csproj: PackageId=KDuma.Pcf, NuGet metadata, README embedded.
Replaces long-lived API tokens with short-lived OIDC tokens issued by GitHub Actions and exchanged at each registry: - crates.io: rust-lang/crates-io-auth-action@v1 (TTL 30 min, shared across three publishes with sleep gaps) - npm: npm CLI >= 11.5.1 detects ACTIONS_ID_TOKEN_* and uses OIDC automatically; provenance attestations are generated by default - NuGet: NuGet/login@v1 exchanges OIDC for a 1h API key right before dotnet nuget push Each publish job declares permissions.id-token: write. Secrets CARGO_REGISTRY_TOKEN, NPM_TOKEN, and NUGET_API_KEY are no longer referenced; trusted publisher policies must be configured on each registry (see plan) before the first release.
New .github/workflows/release-prepare.yml is a workflow_dispatch tool that bumps versions across every package in a single commit, tags v<version>, and triggers release.yml. Patch is auto-incremented from reference/PCF-v1.0/Cargo.toml when no explicit version is provided. Files bumped per run: - 3x Cargo.toml (incl. pcf path-dep version pins in pfs-ms and pcf-debug) - implementations/ts/package.json (+ package-lock.json via npm version) - implementations/dotnet/src/Pcf/Pcf.csproj The triggered release.yml is now also called explicitly via 'gh workflow run' because GITHUB_TOKEN-pushed tags do not fire push triggers in other workflows. Also: - All packages reset to baseline 0.0.1 (was a mix of 1.0.0 / 0.1.0) so the first bump runs against a clean state. - Removed redundant 'Set workspace versions' (sed) step from release.yml publish-crates job and the 'Set version' (npm version) step from publish-npm; bumps now live in the prep commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR establishes a comprehensive release automation system and updates package metadata across all implementations to prepare for publishing to public registries.
Key Changes
Release Automation
New
release.ymlworkflow: Orchestrates the complete release process triggered by version tags or manual dispatchNew
build-binaries.ymlworkflow: Reusable workflow for cross-platform binary compilationpcf-debugandpfsbinaries for all target platformsNew
php-split.ymlworkflow: Continuous PHP subtree split on master branchimplementations/phpto separate packagist repositoryPackage Metadata Updates
TypeScript (npm)
pcfto@kduma-oss/pcfC# (.NET/NuGet)
PHP (Composer)
kduma-oss/pcftokduma/pcfRust (crates.io)
Implementation Details
https://claude.ai/code/session_01AoTYcop5wbGoezzpq1ynU2