Conversation
Adds a GitHub Actions workflow to build, test, and publish the npm package for @bsull/augurs using trusted publishing.
Contributor
WalkthroughA GitHub Actions workflow is added to automate building, testing, and publishing the Changes
Sequence DiagramsequenceDiagram
actor User
participant GitHub as GitHub Actions
participant Rust as Rust Toolchain
participant Builder as WASM Builder
participant Tests as Test Suite
participant Artifacts as Artifact Storage
participant NPM as npm Registry
User->>GitHub: Push release tag or dispatch workflow
GitHub->>Rust: Install nightly + wasm32 target
Rust-->>GitHub: Toolchain ready
GitHub->>Builder: Build augurs-js with wasm-pack
Builder-->>GitHub: Build complete
GitHub->>Tests: Run typecheck and unit tests
Tests-->>GitHub: Tests passed
GitHub->>Artifacts: Upload js-package artifact (5-day retention)
Artifacts-->>GitHub: Artifact stored
GitHub->>NPM: Download artifact & publish to npm
NPM-->>GitHub: Package published with OIDC provenance
GitHub-->>User: Workflow complete
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (4)
.github/workflows/js-release.yml (4)
61-64:registry-urlis unnecessary in the build-and-test job.This option configures
.npmrcfor publishing auth (it's only needed in thepublishjob). The default npm registry is alreadyhttps://registry.npmjs.org, so this setting is redundant for test runs.🧹 Proposed cleanup
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 with: node-version-file: js/.node-version - registry-url: "https://registry.npmjs.org"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/js-release.yml around lines 61 - 64, Remove the unnecessary registry-url setting from the actions/setup-node step used in the build-and-test job: in the setup-node invocation that uses node-version-file: js/.node-version, delete the registry-url: "https://registry.npmjs.org" entry so tests use the default registry; keep any registry-url configuration only in the publish job's setup-node step where publishing auth is required.
93-110: Reorder steps: checkout before artifact download to avoid fragile workspace state.
actions/checkoutdefaults toclean: true(git clean -ffdx). On a fresh GitHub-hosted runner this is harmless (no pre-existing.git), but on any runner with a pre-existing workspace the checkout would delete the downloadedpackage/directory beforenpm publishhas a chance to use it. The canonical order is checkout → download.🔧 Proposed reorder
steps: - - name: Download JS package - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: js-package - path: package/ - - - name: Checkout sources - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - - - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 - with: - node-version-file: js/.node-version - registry-url: "https://registry.npmjs.org" + - name: Checkout sources + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 + with: + node-version-file: js/.node-version + registry-url: "https://registry.npmjs.org" + + - name: Download JS package + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + with: + name: js-package + path: package/🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/js-release.yml around lines 93 - 110, The workflow step order is fragile: the "Checkout sources" step (uses: actions/checkout) must run before "Download JS package" (uses: actions/download-artifact) so the checkout's git-clean won't remove the downloaded package; reorder the steps so the actions/checkout step executes prior to actions/download-artifact, keeping the subsequent setup-node and "Publish to npm" (working-directory: package) steps unchanged.
109-111:--provenanceis redundant when using npm trusted publishing.When you publish using trusted publishing, npm automatically generates and publishes provenance attestations for your package — you don't need to add the
--provenanceflag to your publish command. The flag is harmless but can be dropped for clarity.🧹 Proposed cleanup
- run: npm publish --provenance --access public + run: npm publish --access public🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/js-release.yml around lines 109 - 111, Remove the redundant --provenance flag from the GitHub Actions "Publish to npm" step; locate the step named "Publish to npm" that runs the command npm publish --provenance --access public and edit the run line to call npm publish --access public instead, leaving the working-directory and access settings unchanged.
49-52:dtolnay/rust-toolchainis missing a version comment.All other pinned actions include a
# vX.Y.Zcomment for auditability. Add the version tag as a comment for consistency:- - uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 + - uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # v1.93.1🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/js-release.yml around lines 49 - 52, Add a version comment for the pinned GitHub Action: update the dtolnay/rust-toolchain invocation (dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9) to include a trailing comment with its semantic version like the other actions (e.g. append a "# vX.Y.Z" comment on the same line) so the action pin remains auditable and consistent with other entries.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/js-release.yml:
- Around line 61-64: Remove the unnecessary registry-url setting from the
actions/setup-node step used in the build-and-test job: in the setup-node
invocation that uses node-version-file: js/.node-version, delete the
registry-url: "https://registry.npmjs.org" entry so tests use the default
registry; keep any registry-url configuration only in the publish job's
setup-node step where publishing auth is required.
- Around line 93-110: The workflow step order is fragile: the "Checkout sources"
step (uses: actions/checkout) must run before "Download JS package" (uses:
actions/download-artifact) so the checkout's git-clean won't remove the
downloaded package; reorder the steps so the actions/checkout step executes
prior to actions/download-artifact, keeping the subsequent setup-node and
"Publish to npm" (working-directory: package) steps unchanged.
- Around line 109-111: Remove the redundant --provenance flag from the GitHub
Actions "Publish to npm" step; locate the step named "Publish to npm" that runs
the command npm publish --provenance --access public and edit the run line to
call npm publish --access public instead, leaving the working-directory and
access settings unchanged.
- Around line 49-52: Add a version comment for the pinned GitHub Action: update
the dtolnay/rust-toolchain invocation
(dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9) to include a
trailing comment with its semantic version like the other actions (e.g. append a
"# vX.Y.Z" comment on the same line) so the action pin remains auditable and
consistent with other entries.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a GitHub Actions workflow to build, test, and publish the npm
package for @bsull/augurs using trusted publishing.
Summary by CodeRabbit