Mint prereleases though publish-package

Co-authored-by: Copilot <copilot@github.com>

Author: noahwc

.github/workflows/mint-components-prerelease.yml

@@ -9,7 +9,6 @@ on:
 permissions:
   id-token: write
   contents: write
-  packages: write
   pull-requests: write
   issues: read
 
@@ -22,23 +21,20 @@ jobs:
         working-directory: packages/mint-components
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # de0fa = v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # 53b83 = v6.3.0
         with:
-          node-version: 20.x
+          node-version: 24
           registry-url: https://registry.npmjs.org
 
       - name: Install packages
         run: npm ci
 
-      - name: Build package
-        run: npm run build
-
       - name: Create release pull request or publish to npm
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # 6a0a8 = v1.7.0
         with:
           version: cd packages/mint-components && npm run version
           publish: cd packages/mint-components && npm run release
@@ -53,15 +49,15 @@ jobs:
 
       - name: Authenticate with Google Cloud
         if: steps.changesets.outputs.published == 'true'
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # 7c6bc = v3
         with:
           token_format: "access_token"
           workload_identity_provider: "projects/167728399658/locations/global/workloadIdentityPools/github/providers/github"
           service_account: "github-static-site-actions@static-site-proxy.iam.gserviceaccount.com"
 
       - name: Setup GCP
         if: steps.changesets.outputs.published == 'true'
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # aa548 = v3.0.1
 
       - name: Deploy docs to bucket
         if: steps.changesets.outputs.published == 'true'

.github/workflows/mint-components-release.yml

@@ -11,6 +11,7 @@ on:
           - express-boilerplate
           - integration-boilerplate-node
           - logger
+          - mint-components
           - program-boilerplate
           - program-test-suite
           - publish-helper
@@ -34,6 +35,12 @@ jobs:
       id-token: write
 
     steps:
+      - name: Enforce mint-components prerelease-only policy
+        if: inputs.package == 'mint-components' && inputs.increment-type != 'prerelease'
+        run: |
+          echo "::error::Stable releases of @saasquatch/mint-components must go through the 'Mint Components Release' workflow (Changesets). This workflow only supports 'prerelease' for mint-components."
+          exit 1
+
       - name: Generate Variables
         id: vars
         run: |

.github/workflows/publish-package.yml

@@ -34,10 +34,11 @@
     "serve:package": "serve . --cors -l 5000",
     "start:raisins": "run-p start serve:package",
     "postinstall": "patch-package",
+    "prepack": "npm run build",
     "changeset": "changeset",
     "version": "changeset version && npm install",
     "release": "changeset publish",
-    "prepublishOnly": "node -e \"if(!process.env.CI)throw new Error('Direct npm publish is disabled for @saasquatch/mint-components. Publish via the Mint Components Release or Mint Components Prerelease GitHub Actions workflow.')\""
+    "prepublishOnly": "node -e \"if(!process.env.CI)throw new Error('Direct npm publish is disabled for @saasquatch/mint-components. Publish via the Mint Components Release (stable) or Publish Package (prerelease) GitHub Actions workflow.')\""
   },
   "devDependencies": {
     "@changesets/changelog-github": "^0.5.2",

packages/mint-components/package.json

@@ -42,28 +42,26 @@ When changesets are merged to the `master` branch, the mint-components release w
    - Deploy the production Stencilbook site for mint-components
    - Create a git tag for the release
 
-mint-components releases are driven by the mint-specific Changesets workflow rather than the generic `publish-package` workflow.
+mint-components stable releases use the mint-specific **Mint Components Release** workflow (Changesets), and prereleases use the shared **Publish Package** workflow.
 
-**Local `npm publish` is blocked.** A `prepublishOnly` script in `package.json` aborts publishes that aren't running in CI (where `CI=true`). All publishes must go through the **Mint Components Release** or **Mint Components Prerelease** GitHub Actions workflows.
+**Local `npm publish` is blocked.** A `prepublishOnly` script in `package.json` aborts publishes that aren't running in CI (where `CI=true`). All publishes must go through the GitHub Actions workflows below.
 
-#### Manual Development Releases
+#### Manual Development Releases (Prereleases)
 
-For development and testing purposes, use the `Mint Components Prerelease` GitHub Actions workflow from the branch you want to publish.
+For development and testing purposes, use the shared **Publish Package** GitHub Actions workflow:
 
-Prereleases are driven manually (not by `changeset pre enter/exit`):
-
-1. On your working branch, edit `version` in [packages/mint-components/package.json](./package.json) to a SemVer prerelease form: `x.y.z-<identifier>` — for example `2.2.0-1`, `2.2.0-beta.0`, or `2.2.0-next.3`. Plain `x.y.z` is rejected by the workflow.
-2. Commit and push the version bump to your branch.
-3. Run the **Mint Components Prerelease** workflow from that branch and supply the `tag` input (npm dist-tag), e.g. `next` or `beta`. The dist-tag `latest` is rejected so prereleases can never replace the stable channel.
+1. Run the workflow from the branch you want to publish.
+2. Set `package` to `mint-components`.
+3. Set `increment-type` to `prerelease`. The workflow rejects `patch` / `minor` / `major` for mint-components — stable releases must go through the **Mint Components Release** (Changesets) workflow.
 
 The workflow will:
 
-- Validate the version is a prerelease and the tag is not `latest`
-- Verify a matching git tag does not already exist
-- Build and publish via `npm publish --tag <tag>`
-- Create and push a `@saasquatch/mint-components@<version>` git tag
+- Compute the next semver from `package.json` (e.g. `2.1.8` → `2.1.9-0` for `prerelease`)
+- Build mint-components automatically via the `prepack` lifecycle script
+- Publish to npm with `--access public --provenance`, tagged `next` for prereleases or `latest` for stable
+- Commit the version bump and create a signed `@saasquatch/mint-components@<version>` git tag via `saasquatch/git-commit-action`
 
-Stable releases continue to flow through `master` via the Changesets "Version Packages" PR. When the next stable release is cut, `changeset version` will compute the next stable version from changesets and overwrite any manual prerelease version in `package.json` — that is intentional.
+Stable releases should still flow through `master` via the Changesets "Version Packages" PR. When the next stable Changesets release runs, `changeset version` will compute the next stable version from changesets and overwrite any manual prerelease version in `package.json` — that is intentional.
 
 ## About Stencil