Zoltan KochanandClaude Opus 5.5
3e4fedc0e9
* ci(release): publish v10 through npm trusted publishing again Every package of 10.34.0 through 10.34.5 was published with NPM_TOKEN, while 10.33.x went out through the trusted publisher. The release workflow did not change its publish command. The Node 20 pin added for the 10.34.0 incident did it: npm's OIDC flow needs Node 22.14 or newer, and on older Node npm quietly uses the static token. Projects that pin a 10.34 release with trustPolicy set to no-downgrade now reject it as a trust downgrade (pnpm/pnpm#16319). Node 20 stays on PATH for the lifecycle scripts that need it. pnpm publish runs those scripts itself and calls npm publish with --ignore-scripts, so npm-path now points at a wrapper that runs npm on Node 24. A final step fails the run if pnpm, the exe wrapper or any platform package lacks trusted-publisher evidence on the registry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci: let a PR that changes no package pass the branch tests The branch test run selects the projects changed since release/10. A change outside every package, such as a workflow edit, selects only the root project, which has no _test script, and pnpm fails with RECURSIVE_RUN_NO_SCRIPT. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci: build and publish v10 with pnpm 12 and pnpm/setup pnpm 12 does npm's trusted publishing (OIDC) itself, so the upload no longer depends on the Node version npm runs on. That replaces the Node 24 npm wrapper and the post-release registry check: pnpm, @pnpm/exe and the platform packages now publish in steps that have no token, so a failed OIDC exchange fails the release instead of falling back to NPM_TOKEN. Only the internal workspace packages still get the token. Every workflow now installs pnpm and Node through pnpm/setup. The global virtual store is off in CI, as pnpm 10 had it: with the store on, pnpm 12 puts an ESM loader in NODE_OPTIONS, and on Node.js older than 22.15 that stops ts-node from running the build scripts. The release install selects the darwin and win32 reflink artifacts with --os/--cpu, because pnpm 12's --force does not install optional dependencies for other platforms. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci: describe the global virtual store setting without history Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
69 lines
3.1 KiB
JSON
69 lines
3.1 KiB
JSON
{
|
|
"name": "monorepo-root",
|
|
"private": true,
|
|
"scripts": {
|
|
"bump": "changeset version && pnpm update-manifests",
|
|
"changeset": "changeset",
|
|
"check:node-release-keys": "node crypto/shasums-file/scripts/update-node-release-keys.mjs",
|
|
"check:npm-signing-keys": "node tools/plugin-commands-self-updater/scripts/update-npm-signing-keys.mjs",
|
|
"update:node-release-keys": "node crypto/shasums-file/scripts/update-node-release-keys.mjs --update",
|
|
"preinstall": "npx only-allow pnpm",
|
|
"prepare": "husky",
|
|
"pretest": "pnpm run compile-only && pnpm --dir=__fixtures__ run prepareFixtures",
|
|
"lint": "pnpm run spellcheck && pnpm lint:meta && pnpm run lint:ts",
|
|
"spellcheck": "cspell \"**/*.ts\" \"**/README.md\" \".changeset/*.md\" --no-progress",
|
|
"lint:ts": "eslint \"**/src/**/*.ts\" \"**/test/**/*.ts\"",
|
|
"test-main": "pnpm pretest && pnpm lint && pnpm run test-pkgs-main",
|
|
"remove-temp-dir": "shx rm -rf ../pnpm_tmp",
|
|
"test-pkgs-main": "pnpm remove-temp-dir && pnpm run --no-sort --workspace-concurrency=1 -r _test",
|
|
"test-branch": "pnpm pretest && pnpm lint && git remote set-branches --add origin release/10 && git fetch origin release/10 && pnpm run test-pkgs-branch",
|
|
"test-pkgs-branch": "pnpm remove-temp-dir && pnpm --workspace-concurrency=1 --filter=...[origin/release/10] run --no-sort --if-present _test",
|
|
"compile-only": "ts-node __utils__/scripts/src/typecheck-only.ts && pnpm -F pnpm compile",
|
|
"compile": "pnpm compile-only && pnpm run update-manifests",
|
|
"make-lcov": "shx mkdir -p coverage && lcov-result-merger './packages/*/coverage/lcov.info' 'coverage/lcov.info'",
|
|
"update-manifests": "pnpm run meta-updater && pnpm install",
|
|
"meta-updater": "pnpm --filter=@pnpm-private/updater compile && pnpm exec meta-updater",
|
|
"lint:meta": "pnpm run meta-updater --test",
|
|
"copy-artifacts": "ts-node __utils__/scripts/src/copy-artifacts.ts",
|
|
"make-release-description": "pnpm --filter=@pnpm/get-release-text run write-release-text",
|
|
"dev-setup": "pnpm -C=./pnpm/dev link -g"
|
|
},
|
|
"devDependencies": {
|
|
"@babel/core": "catalog:",
|
|
"@babel/preset-typescript": "catalog:",
|
|
"@babel/types": "catalog:",
|
|
"@changesets/cli": "catalog:",
|
|
"@commitlint/cli": "catalog:",
|
|
"@commitlint/config-conventional": "catalog:",
|
|
"@commitlint/prompt-cli": "catalog:",
|
|
"@pnpm/eslint-config": "workspace:*",
|
|
"@pnpm/jest-config": "workspace:*",
|
|
"@pnpm/meta-updater": "catalog:",
|
|
"@pnpm/tgz-fixtures": "catalog:",
|
|
"@pnpm/tsconfig": "workspace:*",
|
|
"@types/jest": "catalog:",
|
|
"@types/node": "catalog:",
|
|
"c8": "catalog:",
|
|
"concurrently": "catalog:",
|
|
"cross-env": "catalog:",
|
|
"cspell": "catalog:",
|
|
"eslint": "catalog:",
|
|
"eslint-plugin-regexp": "catalog:",
|
|
"husky": "catalog:",
|
|
"jest": "catalog:",
|
|
"keyv": "catalog:",
|
|
"lcov-result-merger": "catalog:",
|
|
"publish-packed": "catalog:",
|
|
"rimraf": "catalog:",
|
|
"shx": "catalog:",
|
|
"ts-jest": "catalog:",
|
|
"ts-node": "catalog:",
|
|
"typescript": "catalog:",
|
|
"verdaccio": "catalog:"
|
|
},
|
|
"engines": {
|
|
"pnpm": ">=9.6.0"
|
|
},
|
|
"packageManager": "pnpm@12.7.0"
|
|
}
|