From eb9b7159d4c1644ecb9baeb85c702ca46c2c6311 Mon Sep 17 00:00:00 2001
From: Dan Ditomaso <dan.ditomaso@gmail.com>
Date: Mon, 18 Aug 2025 09:07:13 -0400
Subject: [PATCH] Refactor github actions with monorepo support (#783)

* refactor github actions with monorepo support

* Update .github/workflows/release-packages.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update .github/workflows/release-packages.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* updates

* changed order of ci/pr steps

* Update .github/workflows/release-web.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* adding lock file

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/ci.yml                      |  14 +-
 .github/workflows/nightly.yml                 |  85 ++++++-----
 .github/workflows/pr.yml                      |  52 +++----
 .github/workflows/release-packages.yml        | 136 ++++++++++--------
 .github/workflows/release-web.yml             |  60 +++++---
 .../workflows/update-stable-from-master.yml   |  73 ++++++----
 .gitignore                                    |   1 +
 package.json                                  |  14 +-
 packages/core/package.json                    |  11 +-
 packages/transport-deno/package.json          |   7 +-
 packages/transport-http/package.json          |  18 +--
 packages/transport-node/package.json          |   5 +-
 packages/transport-web-bluetooth/package.json |  12 +-
 packages/transport-web-serial/package.json    |  12 +-
 14 files changed, 306 insertions(+), 194 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6b7e6d19..332ea63f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,16 +15,18 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+      
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: latest
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 22
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: latest
+          cache: pnpm
+          cache-dependency-path: '**/pnpm-lock.yaml'
 
       - name: Setup Deno
         uses: denoland/setup-deno@v2
@@ -59,7 +61,7 @@ jobs:
 
             if [[ -f "$pkg_dir/package.json" ]] && [[ "$pkg_dir" != "packages/web" ]]; then
               echo "🔧 Building with pnpm: $pkg_dir"
-              (cd "$pkg_dir" && pnpm install && pnpm run build:npm)
+              (cd "$pkg_dir" && pnpm install --frozen-lockfile && pnpm run build:npm)
             else
               echo "⚠️ Skipping $pkg_dir (web package or no package.json)"
             fi
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 08dd6bd2..94faaaca 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -1,91 +1,101 @@
-name: "Nightly Release"
+name: Nightly Release
 
 on:
   schedule:
-    - cron: "0 5 * * *" # Run every day at 5am UTC
+    - cron: "0 5 * * *" # 05:00 UTC daily
+  workflow_dispatch: {}   # allow manual runs too
 
 permissions:
-  contents: write
+  contents: read
   packages: write
 
+env:
+  REGISTRY_IMAGE: ghcr.io/${{ github.repository }}
+
 jobs:
   nightly-build-and-push:
     runs-on: ubuntu-latest
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # Node + pnpm (with built-in cache)
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 22
+          cache: pnpm
+          cache-dependency-path: '**/pnpm-lock.yaml'
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
           version: latest
 
-      - name: Cache pnpm dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.pnpm-store
-            packages/web/node_modules
-          key: ${{ runner.os }}-pnpm-${{ hashFiles('packages/web/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm- 
+      - name: Install deps (root)
+        run: pnpm install --frozen-lockfile
 
       - name: Run tests
         run: pnpm run test
 
-      - name: Install Dependencies
-        working-directory: packages/web
-        run: pnpm install
-
-      - name: Build Package
+      - name: Build web package
         working-directory: packages/web
         run: pnpm run build
 
-      - name: Package Output
+      - name: Package output
         working-directory: packages/web
         run: pnpm run package
 
-      - name: Archive compressed build
+      - name: Upload compressed build (artifact)
         uses: actions/upload-artifact@v4
         with:
-          name: build
+          name: web-build-nightly
           path: packages/web/dist/build.tar
+          if-no-files-found: error
 
-      - name: Get latest release version
-        id: get_release
+      - name: Determine nightly tag
+        id: meta
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          LATEST_TAG=$(curl -sL \
-            -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-            https://api.github.com/repos/${{ github.repository }}/releases/latest | jq -r ".tag_name")
-          # Fallback to a default if no release is found
-          if [ -z "$LATEST_TAG" ]; then
-            LATEST_TAG="2.6.0"
+          set -euo pipefail
+          DATE="$(date -u +%Y%m%d)"
+          SHORTSHA="$(git rev-parse --short=12 HEAD)"
+          # Try to use latest release tag if it exists; fallback to package version; else date
+          LATEST_TAG="$(gh release view --json tagName --jq .tagName 2>/dev/null || true)"
+          if [ -z "$LATEST_TAG" ] && [ -f packages/web/package.json ]; then
+            LATEST_TAG="v$(jq -r .version packages/web/package.json)"
           fi
-          echo "tag=${LATEST_TAG}" >> $GITHUB_OUTPUT
+          if [ -n "$LATEST_TAG" ] && [ "$LATEST_TAG" != "vnull" ]; then
+            TAG="nightly-${LATEST_TAG}-${SHORTSHA}"
+          else
+            TAG="nightly-${DATE}-${SHORTSHA}"
+          fi
+          echo "tag=$TAG"        >> "$GITHUB_OUTPUT"
+          echo "tags=nightly, $TAG" >> "$GITHUB_OUTPUT"
+          echo "Resolved nightly tags: nightly, $TAG"
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
-      - name: Buildah Build
+      - name: Build Container Image (multi-arch)
         id: build-container
         uses: redhat-actions/buildah-build@v2
         with:
           containerfiles: |
             ./packages/web/infra/Containerfile
-          image: ${{ github.event.repository.full_name }}
-          tags: nightly-${{ steps.get_release.outputs.tag }}-${{ github.sha }}
-
-
+          image: ${{ env.REGISTRY_IMAGE }}
+          tags: ${{ steps.meta.outputs.tags }}
           oci: true
           platforms: linux/amd64, linux/arm64
+          labels: |
+            org.opencontainers.image.source=${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.created=${{ github.run_id }}
 
-      - name: Push To Registry
+      - name: Push To GHCR
         id: push-to-registry
         uses: redhat-actions/push-to-registry@v2
         with:
@@ -95,6 +105,5 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Print image url
+      - name: Print image URL
         run: echo "Image pushed to ${{ steps.push-to-registry.outputs.registry-paths }}"
-
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 98c1bb76..5e1c27cb 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -1,52 +1,52 @@
 name: Pull Request CI
 
-on: pull_request
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
+
+concurrency:
+  group: pr-${{ github.event.pull_request.number }}-ci
+  cancel-in-progress: true
+
+env:
+  CI: true
 
 jobs:
   build-and-package:
     runs-on: ubuntu-latest
+    # Skip for draft PRs; remove this line if you want to run on drafts too
+    if: ${{ github.event.pull_request.draft == false }}
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
+      
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
           version: latest
 
-      - name: Install Dependencies
-        # Commands will run from 'packages/web'
-        working-directory: packages/web
-        run: pnpm install
-
-      - name: Cache pnpm dependencies
-        uses: actions/cache@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          path: |
-            ~/.pnpm-store
-            packages/web/node_modules
-          key: ${{ runner.os }}-pnpm-${{ hashFiles('packages/web/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: '**/pnpm-lock.yaml'
+
+      - name: Install dependencies (root)
+        run: pnpm install --frozen-lockfile
 
       - name: Run linter
         run: pnpm run lint
 
-      - name: Check formatter  
+      - name: Check formatter
         run: pnpm run check
 
       - name: Run tests
         run: pnpm run test
 
-      - name: Build Package
-        working-directory: packages/web
-        run: pnpm run build
+      - name: Build web package
+        run: pnpm --filter "./packages/web" run build
diff --git a/.github/workflows/release-packages.yml b/.github/workflows/release-packages.yml
index 17f920ec..63e59f21 100644
--- a/.github/workflows/release-packages.yml
+++ b/.github/workflows/release-packages.yml
@@ -11,81 +11,103 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write   # <-- required for JSR OIDC
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      # --- Setup Node.js and pnpm ---
-      - name: Setup Node.js
+      # Node + pnpm (with cache)
+      - name: Setup Node
         uses: actions/setup-node@v4
         with:
           node-version: 22
+          cache: pnpm
+          cache-dependency-path: '**/pnpm-lock.yaml'
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
           version: latest
 
-      # --- Setup Deno ---
-      - name: Setup Deno
-        uses: denoland/setup-deno@v2
-        with:
-          deno-version: v2.x
-
-      # --- Cache pnpm Dependencies ---
-      - name: Cache pnpm Dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.pnpm-store
-            packages/web/node_modules
-          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-
-
-      # --- Cache Deno Dependencies ---
-      - name: Cache Deno Dependencies
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/deno
-          key: ${{ runner.os }}-deno-${{ hashFiles('**/deno.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-deno-
-
-      - name: Configure pnpm registry
-        run: pnpm config set registry https://registry.npmjs.org/
-
-      - name: Configure pnpm auth
-        run: pnpm config set //registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}
-
-      - name: Publish packages to npm and JSR
+      - name: Configure npm auth
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
-          for dir in packages/*; do
-            if [ "$dir" != "packages/web" ]; then
-              echo "Processing $dir"
+          pnpm config set //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+          pnpm config set registry https://registry.npmjs.org/
 
-              cd $dir
+      - name: Install deps (root)
+        run: pnpm install
 
-              # Build and publish to npm if package.json exists
-              if [ -f "package.json" ]; then
-                echo "Building and publishing $dir to npm..."
-                pnpm install
-                pnpm run build:npm
-                pnpm run publish:npm || echo "npm publish failed for $dir"
-              fi
+      - name: Resolve package list
+        id: pkgs
+        shell: bash
+        run: |
+          if [ "${{ github.event.inputs.packages }}" = "all" ] || [ -z "${{ github.event.inputs.packages }}" ]; then
+            mapfile -t TARGETS < <(ls -d packages/* | grep -v 'packages/web')
+          else
+            IFS=',' read -ra TARGETS <<< "${{ github.event.inputs.packages }}"
+            TARGETS=("${TARGETS[@]/#/packages/}")
+          fi
+          printf '%s\n' "${TARGETS[@]}" | paste -sd, - > targets.txt
+          echo "list=$(cat targets.txt)" >> "$GITHUB_OUTPUT"
 
-              pnpm run prepare:jsr
+      - name: Build selected packages (tsdown)
+        run: |
+          IFS=',' read -ra TARGETS <<< "${{ steps.pkgs.outputs.list }}"
+          for dir in "${TARGETS[@]}"; do
+            echo "Building $dir"
+            pnpm --filter "./$dir" run build
+          done
 
-              # Publish to JSR if jsr.json exists
-              if [ -f "jsr.json" ]; then
-                echo "Publishing $dir to jsr..."
-                deno publish || echo "JSR publish failed for $dir"
-              fi
-
-              cd - > /dev/null
-            else
-              echo "Skipping $dir"
+      - name: Sync jsr.json version from package.json
+        run: |
+          IFS=',' read -ra TARGETS <<< "${{ steps.pkgs.outputs.list }}"
+          for dir in "${TARGETS[@]}"; do
+            if [ -f "$dir/jsr.json" ] && [ -f "$dir/package.json" ]; then
+              PKG_VER=$(jq -r .version "$dir/package.json")
+              jq --arg v "$PKG_VER" '.version = $v' "$dir/jsr.json" > "$dir/jsr.json.tmp" && mv "$dir/jsr.json.tmp" "$dir/jsr.json"
+              echo "Updated $dir/jsr.json to version $PKG_VER"
             fi
           done
 
-    
\ No newline at end of file
+      - name: Publish to JSR (OIDC)
+        run: |
+          set -euo pipefail
+          IFS=',' read -ra TARGETS <<< "${{ steps.pkgs.outputs.list }}"
+          for dir in "${TARGETS[@]}"; do
+            if [ -f "$dir/jsr.json" ]; then
+              echo "Publishing $dir to JSR via OIDC…"
+              cd "$dir"
+              [ -d dist ] || pnpm run build
+              if ! npx --yes jsr publish 2>&1 | tee jsr_publish.log; then
+                echo "JSR publish failed for $dir. Error output:"
+                cat jsr_publish.log
+              fi
+              cd - >/dev/null
+            fi
+          done
+
+      - name: Replace exports entry in package.json
+        run: |
+          tmp=$(mktemp)
+          jq '.exports["."] = "./dist/mod.mjs"' package.json > "$tmp" \
+          && mv "$tmp" package.json
+
+      - name: Publish to npm
+        run: |
+          set -euo pipefail
+          IFS=',' read -ra TARGETS <<< "${{ steps.pkgs.outputs.list }}"
+          for dir in "${TARGETS[@]}"; do
+            if [ -f "$dir/package.json" ]; then
+              echo "Publishing $dir to npm…"
+              cd "$dir"
+              [ -d dist ] || pnpm run build
+              npm publish --access public || echo "npm publish failed for $dir"
+              cd - >/dev/null
+            fi
+          done
+
+
diff --git a/.github/workflows/release-web.yml b/.github/workflows/release-web.yml
index c8d87ba6..e8f14687 100644
--- a/.github/workflows/release-web.yml
+++ b/.github/workflows/release-web.yml
@@ -10,7 +10,7 @@ on:
         required: false
         default: ""
       tag_name:
-        description: "Tag to use for artifacts/images (defaults to adhoc-<sha>)"
+        description: "Tag to use for artifacts/images (defaults to <sha>)"
         required: false
         default: ""
       attach_to_release:
@@ -36,53 +36,56 @@ jobs:
           # For manual runs, allow building a chosen ref (branch/tag/SHA)
           ref: ${{ inputs.ref != '' && inputs.ref || github.ref }}
 
-      - name: Determine tag for this run
+      - name: Determine tag & latest flag
         id: meta
+        shell: bash
         run: |
-          # tag from release event, or user input, or fallback to adhoc-<shortsha>
+          # Determine TAG
           if [ "${{ github.event_name }}" = "release" ]; then
             TAG="${{ github.event.release.tag_name }}"
+            # Push "latest" only for full releases (not prereleases)
+            if [ "${{ github.event.release.prerelease }}" = "true" ]; then
+              PUSH_LATEST="false"
+            else
+              PUSH_LATEST="true"
+            fi
           elif [ -n "${{ inputs.tag_name }}" ]; then
             TAG="${{ inputs.tag_name }}"
+            PUSH_LATEST="false"
           else
             SHA="$(git rev-parse --short=12 HEAD)"
             TAG="adhoc-${SHA}"
+            PUSH_LATEST="false"
           fi
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "Resolved tag: $TAG"
 
-      # --- Setup Node.js and pnpm ---
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "push_latest=$PUSH_LATEST" >> "$GITHUB_OUTPUT"
+          echo "Resolved tag: $TAG (push_latest=$PUSH_LATEST)"
+
+      # --- Setup Node.js and pnpm (with cache) ---
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 22
+          cache: pnpm
+          cache-dependency-path: '**/pnpm-lock.yaml'
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
           version: latest
 
-      # --- Cache pnpm Dependencies ---
-      - name: Cache pnpm Dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.pnpm-store
-            packages/web/node_modules
-          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
       - name: Create Web App Release Archive
-        run: pnpm --filter "meshtastic-web" run package
+        working-directory: packages/web
+        run: pnpm run package
 
       - name: Upload Web App Archive (artifact)
         uses: actions/upload-artifact@v4
         with:
-          name: web-build
+          name: web-build-${{ steps.meta.outputs.tag }}
           if-no-files-found: error
           path: packages/web/dist/build.tar
 
@@ -90,6 +93,7 @@ jobs:
         if: ${{ github.event_name == 'release' || inputs.attach_to_release == true }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
         run: |
           if [ "${{ github.event_name }}" = "release" ]; then
             TAG="${{ steps.meta.outputs.tag }}"
@@ -105,6 +109,22 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
+      - name: Compute image tags
+        id: tags
+        shell: bash
+        run: |
+          if [ "${{ steps.meta.outputs.push_latest }}" = "true" ]; then
+            echo "list=latest, ${{ steps.meta.outputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "list=${{ steps.meta.outputs.tag }}" >> "$GITHUB_OUTPUT"
+          fi
+            TAGS="latest, ${{ steps.meta.outputs.tag }}"
+          else
+            TAGS="${{ steps.meta.outputs.tag }}"
+          fi
+          echo "list=$TAGS" >> "$GITHUB_OUTPUT"
+          echo "Using image tags: $TAGS"
+
       - name: Build Container Image
         id: build-container
         uses: redhat-actions/buildah-build@v2
@@ -112,7 +132,7 @@ jobs:
           containerfiles: |
             ./packages/web/infra/Containerfile
           image: ${{ env.REGISTRY_IMAGE }}
-          tags: latest, ${{ steps.meta.outputs.tag }}
+          tags: ${{ steps.tags.outputs.list }}
           oci: true
           platforms: linux/amd64, linux/arm64
 
diff --git a/.github/workflows/update-stable-from-master.yml b/.github/workflows/update-stable-from-master.yml
index 7510939a..39bda8e6 100644
--- a/.github/workflows/update-stable-from-master.yml
+++ b/.github/workflows/update-stable-from-master.yml
@@ -7,44 +7,67 @@ on:
 permissions:
   contents: write
 
+concurrency:
+  group: update-stable-${{ github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   update-stable-branch:
-    name: Update Stable Branch from Main
+    name: Update stable from latest release source
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0  # need full history for reset/push
 
-      - name: Configure Git
+      - name: Configure Git author
         run: |
-          git config user.name "GitHub Actions Bot"
+          git config user.name  "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
-      - name: Fetch latest main and stable branches
+      - name: Determine source ref & SHA
+        id: meta
+        shell: bash
         run: |
-          git fetch origin main:main
-          git fetch origin stable:stable || echo "Stable branch not found remotely, will create."
-
-      - name: Get latest main commit SHA
-        id: get_main_sha
-        run: echo "MAIN_SHA=$(git rev-parse main)" >> $GITHUB_ENV
-
-      - name: Check out stable branch
-        run: |
-          if git show-ref --verify --quiet refs/heads/stable; then
-            git checkout stable
-            git pull origin stable # Sync with remote stable if it exists
-          else
-            echo "Creating local stable branch based on main HEAD."
-            git checkout -b stable ${{ env.MAIN_SHA }}
+          set -euo pipefail
+          SRC="${{ github.event.release.target_commitish }}"
+          if [ -z "$SRC" ] || ! git ls-remote --exit-code origin "refs/heads/$SRC" >/dev/null 2>&1; then
+            # Fallback to main if target_commitish is empty or not a branch
+            SRC="main"
           fi
 
-      - name: Reset stable branch to latest main
-        run: git reset --hard ${{ env.MAIN_SHA }}
+          echo "Using source branch: $SRC"
+          git fetch origin "$SRC":"refs/remotes/origin/$SRC" --prune
+          SHA="$(git rev-parse "origin/$SRC")"
+          echo "sha=$SHA"   >> "$GITHUB_OUTPUT"
+          echo "src=$SRC"   >> "$GITHUB_OUTPUT"
 
-      - name: Force push stable branch
-        run: git push origin stable --force
+      - name: Prepare local stable branch
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Ensure we have the remote stable ref if it exists
+          git fetch origin stable:refs/remotes/origin/stable || true
+
+          if git show-ref --verify --quiet refs/heads/stable; then
+            echo "Local stable exists."
+          elif git show-ref --verify --quiet refs/remotes/origin/stable; then
+            echo "Creating local stable tracking branch from remote."
+            git checkout -b stable --track origin/stable
+          else
+            echo "Creating new local stable branch at source SHA."
+            git checkout -b stable "${{ steps.meta.outputs.sha }}"
+          fi
+
+      - name: Reset stable to source SHA
+        run: |
+          git checkout stable
+          git reset --hard "${{ steps.meta.outputs.sha }}"
+          git status --short --branch
+
+      - name: Push stable (force-with-lease)
+        run: |
+          # Safer than --force; refuses if remote moved unexpectedly
+          git push origin stable --force-with-lease
diff --git a/.gitignore b/.gitignore
index 40163db1..97442988 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,4 @@ __screenshots__*
 *.diff
 npm/
 .idea
+**/LICENSE
diff --git a/package.json b/package.json
index 492a2d07..ea88d006 100644
--- a/package.json
+++ b/package.json
@@ -1,5 +1,5 @@
 {
-	"name": "meshtastic-web",
+	"name": "@meshtastic/web",
 	"version": "2.7.0-0",
 	"type": "module",
 	"description": "Meshtastic web client monorepo",
@@ -25,7 +25,7 @@
 		"check:fix": "biome check --write",
 		"build:all": "pnpm run --filter '*' build",
 		"clean:all": "pnpm run --filter '*' clean",
-		"publish:packages": "pnpm run --filter 'packages/transport-* packages/core' build",
+		"publish:packages": "pnpm run build --filter 'packages/transport-*'",
 		"test": "vitest"
 	},
 	"dependencies": {
@@ -39,6 +39,14 @@
 		"biome": "^0.3.3",
 		"tsdown": "^0.13.4",
 		"typescript": "^5.8.3",
-		"vitest": "^3.2.4" 
+		"vitest": "^3.2.4"
+	},
+	"pnpm": {
+		"onlyBuiltDependencies": [
+			"@tailwindcss/oxide",
+			"core-js",
+			"esbuild",
+			"simple-git-hooks"
+		]
 	}
 }
diff --git a/packages/core/package.json b/packages/core/package.json
index 77383ea9..dca94356 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,10 +1,11 @@
 {
   "name": "@meshtastic/core",
-	"version": "2.6.6",
+	"version": "2.6.6-1",
 	"description": "Core functionalities for Meshtastic web applications.",
   "exports": {
 		".": "./mod.ts"
 	},
+  "type": "module", 
   "main": "./dist/mod.mjs",       
   "module": "./dist/mod.mjs",     
   "types": "./dist/mod.d.mts",    
@@ -16,12 +17,18 @@
     "splitting": false,
     "clean": true
   },
+    "files": [
+    "package.json",
+    "README.md",
+    "LICENSE",
+    "dist"
+  ],
   "scripts": {
     "preinstall": "npx only-allow pnpm",
     "prepack": "cp ../../LICENSE ./LICENSE",
     "clean": "rm -rf dist LICENSE",
     "build:npm": "tsdown",
-    "publish:npm": "pnpm clean && pnpm build:npm && pnpm publish --access public",
+    "publish:npm": "pnpm clean && pnpm build:npm && pnpm publish --access public --no-git-checks",
     "prepare:jsr": "rm -rf dist && pnpm dlx pkg-to-jsr",
     "publish:jsr": "pnpm run prepack && pnpm prepare:jsr && deno publish --allow-dirty --no-check"
   },
diff --git a/packages/transport-deno/package.json b/packages/transport-deno/package.json
index 531deb36..385a1d28 100644
--- a/packages/transport-deno/package.json
+++ b/packages/transport-deno/package.json
@@ -8,7 +8,6 @@
 	"main": "./dist/mod.mjs",       
   "module": "./dist/mod.mjs",     
   "types": "./dist/mod.d.mts",    
-  "files": ["dist/*", "mod.ts", "README.md", "../../LICENSE"],
   "license": "GPL-3.0-only",
   "tsdown": {
     "entry": "mod.ts",
@@ -17,6 +16,12 @@
     "splitting": false,
     "clean": true
   },
+  "files": [
+    "package.json",
+    "README.md",
+    "LICENSE",
+    "dist"
+  ],
   "scripts": {
     "preinstall": "npx only-allow pnpm",
     "prepack": "cp ../../LICENSE ./LICENSE",
diff --git a/packages/transport-http/package.json b/packages/transport-http/package.json
index 64ba5a47..228956b1 100644
--- a/packages/transport-http/package.json
+++ b/packages/transport-http/package.json
@@ -1,8 +1,15 @@
 {
 	"name": "@meshtastic/transport-http",
-	"version": "0.2.3",
+	"version": "0.2.3-2",
 	"description": "A transport layer for Meshtastic applications using HTTP.",
   "exports": {".": "./mod.ts"},
+  "type": "module", 
+    "files": [
+    "package.json",
+    "README.md",
+    "LICENSE",
+    "dist"
+  ],
   "main": "./dist/mod.mjs",       
   "module": "./dist/mod.mjs",     
   "types": "./dist/mod.d.mts",    
@@ -14,18 +21,13 @@
     "splitting": false,
     "clean": true
   },
-  "files": [
-    "package.json",
-    "README.md",
-    "LICENSE",
-    "dist"
-  ],
   "scripts": {
    "preinstall": "npx only-allow pnpm",
     "prepack": "cp ../../LICENSE ./LICENSE",
     "clean": "rm -rf dist LICENSE",
     "build:npm": "tsdown",
-    "publish:npm": "pnpm clean && pnpm build:npm && pnpm publish --access public",
+
+    "publish:npm": "pnpm clean && pnpm build:npm && pnpm publish --access public --no-git-checks",
     "prepare:jsr": "rm -rf dist && pnpm dlx pkg-to-jsr",
     "publish:jsr": "pnpm run prepack && pnpm prepare:jsr && deno publish --allow-dirty --no-check"
   },
diff --git a/packages/transport-node/package.json b/packages/transport-node/package.json
index c92e562b..a40c3a73 100644
--- a/packages/transport-node/package.json
+++ b/packages/transport-node/package.json
@@ -1,10 +1,11 @@
 {
 	"name": "@meshtastic/transport-node",
-	"version": "0.0.1",
+	"version": "0.0.1-1",
 	"description": "NodeJS-specific transport layer for Meshtastic web applications.",
 	"exports": {
 		".": "./mod.ts"
 	},
+  "type": "module", 
 	"main": "./dist/mod.mjs",       
   "module": "./dist/mod.mjs",     
   "types": "./dist/mod.d.mts",    
@@ -28,7 +29,7 @@
     "prepack": "cp ../../LICENSE ./LICENSE",
     "clean": "rm -rf dist LICENSE",
     "build:npm": "tsdown",
-    "publish:npm": "pnpm clean && pnpm build:npm && pnpm publish --access public",
+    "publish:npm": "pnpm clean && pnpm build:npm && pnpm publish --access public --no-git-checks",
     "prepare:jsr": "rm -rf dist && pnpm dlx pkg-to-jsr",
     "publish:jsr": "pnpm run prepack && pnpm prepare:jsr && deno publish --allow-dirty --no-check"
   },
diff --git a/packages/transport-web-bluetooth/package.json b/packages/transport-web-bluetooth/package.json
index f1562983..020c81ff 100644
--- a/packages/transport-web-bluetooth/package.json
+++ b/packages/transport-web-bluetooth/package.json
@@ -1,14 +1,20 @@
 {
   "name": "@meshtastic/transport-web-bluetooth",
-  "version": "0.1.4",
+  "version": "0.1.4-1",
   "description": "A transport layer for Meshtastic applications using Web Bluetooth.",
   "exports": {
     ".": "./mod.ts"
   },
+  "type": "module", 
   "main": "./dist/mod.mjs",       
   "module": "./dist/mod.mjs",     
   "types": "./dist/mod.d.mts",    
-  "files": ["dist/*", "mod.ts", "README.md", "../../LICENSE"],
+  "files": [
+    "package.json",
+    "README.md",
+    "LICENSE",
+    "dist"
+  ],
   "license": "GPL-3.0-only",
   "tsdown": {
     "entry": "mod.ts",
@@ -22,7 +28,7 @@
     "prepack": "cp ../../LICENSE ./LICENSE",
     "clean": "rm -rf dist LICENSE",
     "build:npm": "tsdown",
-    "publish:npm": "pnpm clean && pnpm build:npm && pnpm publish --access public",
+    "publish:npm": "pnpm clean && pnpm build:npm && pnpm publish --access public --no-git-checks",
     "prepare:jsr": "rm -rf dist && pnpm dlx pkg-to-jsr",
     "publish:jsr": "pnpm run prepack && pnpm prepare:jsr && deno publish --allow-dirty --no-check"
   },
diff --git a/packages/transport-web-serial/package.json b/packages/transport-web-serial/package.json
index 90535ba6..f615b8d0 100644
--- a/packages/transport-web-serial/package.json
+++ b/packages/transport-web-serial/package.json
@@ -1,14 +1,20 @@
 {
   "name": "@meshtastic/transport-web-serial",
-  "version": "0.2.3",
+  "version": "0.2.3-1",
 	"description": "A transport layer for Meshtastic applications using Web Serial API.",
 	"exports": {
 		".": "./mod.ts"
 	},
+  "type": "module", 
   "main": "./dist/mod.mjs",       
   "module": "./dist/mod.mjs",     
   "types": "./dist/mod.d.mts",    
-  "files": ["dist/*", "mod.ts", "README.md", "../../LICENSE"],
+  "files": [
+    "package.json",
+    "README.md",
+    "LICENSE",
+    "dist"
+  ],
   "license": "GPL-3.0-only",
   "tsdown": {
     "entry": "mod.ts",
@@ -22,7 +28,7 @@
     "prepack": "cp ../../LICENSE ./LICENSE",
     "clean": "rm -rf dist LICENSE",
     "build:npm": "tsdown",
-    "publish:npm": "pnpm clean && pnpm build:npm && pnpm publish --access public",
+    "publish:npm": "pnpm clean && pnpm build:npm && pnpm publish --access public --no-git-checks",
     "prepare:jsr": "rm -rf dist && pnpm dlx pkg-to-jsr",
     "publish:jsr": "pnpm run prepack && pnpm prepare:jsr && deno publish --allow-dirty --no-check"
   },