Move npm publishing from the local release script to the tag-triggered
Release workflow, authenticated with npm Trusted Publishing (OIDC) so no
npm token is needed. Local `release-all` now only bumps versions, updates
the lockfile, commits, tags, and pushes.
- Add cli/scripts/publish-npm.ts: publish platform packages, wait until
they are live, then publish the main package; skip versions already on
npm so a failed run can be re-run.
- Drop the platform optionalDependencies from cli/package.json. The
published main package gets them from prepare-npm-packages; the
workspace copy only made bun.lock depend on not-yet-published versions.
- prepare-npm-packages: exit(1) instead of warn-and-continue when a
platform binary is missing, so a broken build aborts the release
- release-all: after publishing platform packages, poll npm view for
every @twsxtd/hapi-<platform> package until it matches the release
version (10min timeout, 15s interval) before publishing the main
package
Fixes#1149
Add validation checks before releasing:
- Ensure we're on the main branch to prevent accidental releases from feature branches
- Verify npm authentication to prevent failed publish attempts
This prevents common release mistakes and improves release workflow reliability.
Consolidate version bumping, building, npm publishing, and git operations into a single release script that handles platform packages first. This solves the issue where optionalDependencies needed platform packages published before bun install could generate complete lockfile hashes.
Changes:
- Created cli/scripts/release-all.ts with support for --dry-run, --publish-npm, and --skip-build flags
- Removed release-it dependency and old release/publish-npm scripts
- Simplified GitHub Actions release workflow to always use --generate-notes
- Deleted obsolete release configuration files (.release-it.json, .release-it.notes.js, publish-npm.ts)
weishu