ci: publish npm packages via trusted publishing, stage releases, add dry_run

.github/workflows/publish.yml

@@ -4,23 +4,37 @@ on:
   schedule:
     - cron: "10 0 * * *"
   workflow_dispatch:
+    inputs:
+      dry_run:
+        type: boolean
+        description: Build and verify all packages without publishing them
+        default: false
 
 jobs:
   web:
     uses: ./.github/workflows/~publish_web.yml
+    permissions:
+      contents: read
+      id-token: write
     secrets: inherit
     with: 
       version: alpha ${{github.run_number}}
       npm_tag: alpha
+      force: ${{ inputs.dry_run == true }}
+      dry_run: ${{ inputs.dry_run == true }}
 
   dotnet:
     uses: ./.github/workflows/~publish_dotnet.yml
     secrets: inherit
     with: 
       version: alpha ${{github.run_number}}
+      force: ${{ inputs.dry_run == true }}
+      dry_run: ${{ inputs.dry_run == true }}
 
   kotlin:
     uses: ./.github/workflows/~publish_kotlin.yml
     secrets: inherit
     with: 
-      version: alpha ${{github.run_number}}
+      version: alpha ${{github.run_number}}
+      force: ${{ inputs.dry_run == true }}
+      dry_run: ${{ inputs.dry_run == true }}

.github/workflows/release.yml

@@ -16,17 +16,26 @@ on:
       release_kotlin_android:
         type: boolean
         description: Release Android packages
-        default: true                
+        default: true
+      dry_run:
+        type: boolean
+        description: Build and verify all selected packages without publishing them
+        default: false
 
 jobs:
   web:
     uses: ./.github/workflows/~publish_web.yml
+    permissions:
+      contents: read
+      id-token: write
     secrets: inherit
     if: (github.event_name == 'push') || (github.event_name == 'workflow_dispatch' && github.event.inputs.release_web == 'true')
     with: 
       version: ${{github.run_number}}
       npm_tag: latest
       force: true
+      stage: true
+      dry_run: ${{ inputs.dry_run == true }}
 
   dotnet:
     uses: ./.github/workflows/~publish_dotnet.yml
@@ -35,11 +44,13 @@ jobs:
     with: 
       version: ${{github.run_number}}
       force: true
+      dry_run: ${{ inputs.dry_run == true }}
 
   kotlin:
     uses: ./.github/workflows/~publish_kotlin.yml
     secrets: inherit
     if: (github.event_name == 'push') || (github.event_name == 'workflow_dispatch' && github.event.inputs.release_kotlin_android == 'true')
     with: 
       version: ${{github.run_number}}
-      force: true
+      force: true
+      dry_run: ${{ inputs.dry_run == true }}

.github/workflows/~publish_dotnet.yml

@@ -7,6 +7,9 @@ on:
       force:
         type: boolean
         default: false
+      dry_run:
+        type: boolean
+        default: false
 
 jobs:
   check:
@@ -45,6 +48,6 @@ jobs:
       - run: npm run build-csharp
 
       - run: npm run nightly-pack -- --platform dotnet --force ${{ inputs.force }}
-      - run: npm run nightly-publish -- --platform dotnet --force ${{ inputs.force }}
+      - run: npm run nightly-publish -- --platform dotnet --force ${{ inputs.force }} --dry-run ${{ inputs.dry_run }}
         env:
           NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}

.github/workflows/~publish_kotlin.yml

@@ -7,6 +7,9 @@ on:
       force:
         type: boolean
         default: false
+      dry_run:
+        type: boolean
+        default: false
 
 jobs:
   check:
@@ -46,7 +49,7 @@ jobs:
       - run: npm run build-kotlin
 
       - run: npm run nightly-pack -- --platform kotlin --force ${{ inputs.force }}
-      - run: npm run nightly-publish -- --platform kotlin --force ${{ inputs.force }}
+      - run: npm run nightly-publish -- --platform kotlin --force ${{ inputs.force }} --dry-run ${{ inputs.dry_run }}
         env:
           ORG_GRADLE_PROJECT_mavenCentralUsername: ${{secrets.OSSRH_USERTOKEN_USERNAME}}
           ORG_GRADLE_PROJECT_mavenCentralPassword: ${{secrets.OSSRH_USERTOKEN_PASSWORD}}

.github/workflows/~publish_web.yml

@@ -10,6 +10,12 @@ on:
       npm_tag:
         type: string
         required: true
+      stage:
+        type: boolean
+        default: false
+      dry_run:
+        type: boolean
+        default: false
 
 
 jobs:
@@ -32,6 +38,9 @@ jobs:
     needs: check
     if: needs.check.outputs.has_changes == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v7
         with: 
@@ -49,6 +58,5 @@ jobs:
       - run: npm run build-monaco
 
       - run: npm run nightly-pack -- --platform web --force ${{ inputs.force }}
-      - run: npm run nightly-publish -- --platform web --force ${{ inputs.force }} --tag ${{ inputs.npm_tag }} 
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPMJS_AUTH_TOKEN }}
+      - run: npm install -g npm@11
+      - run: npm run nightly-publish -- --platform web --force ${{ inputs.force }} --tag ${{ inputs.npm_tag }} --stage ${{ inputs.stage }} --dry-run ${{ inputs.dry_run }}

packages/alphatab/package.json

@@ -18,7 +18,7 @@
     "license": "MPL-2.0",
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/coderline/alphaTab.git"
+        "url": "git+https://github.com/CoderLine/alphaTab.git"
     },
     "type": "module",
     "main": "dist/alphaTab.js",

packages/lsp/package.json

@@ -23,7 +23,7 @@
     "license": "MPL-2.0",
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/coderline/alphaTab.git"
+        "url": "git+https://github.com/CoderLine/alphaTab.git"
     },
     "scripts": {
         "clean": "rimraf dist",

packages/monaco/package.json

@@ -20,7 +20,7 @@
     "license": "MPL-2.0",
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/coderline/alphaTab.git"
+        "url": "git+https://github.com/CoderLine/alphaTab.git"
     },
     "scripts": {
         "clean": "rimraf dist",

packages/vite/package.json

@@ -19,7 +19,7 @@
     "license": "MPL-2.0",
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/coderline/alphaTab.git"
+        "url": "git+https://github.com/CoderLine/alphaTab.git"
     },
     "type": "module",
     "exports": {

packages/webpack/package.json

@@ -19,7 +19,7 @@
     "license": "MPL-2.0",
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/coderline/alphaTab.git"
+        "url": "git+https://github.com/CoderLine/alphaTab.git"
     },
     "type": "module",
     "exports": {

scripts/nightly.mts

@@ -1,4 +1,4 @@
-import { type ExecSyncOptionsWithBufferEncoding, execSync } from 'node:child_process';
+import { execSync } from 'node:child_process';
 import { appendFileSync, existsSync, readdirSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { exit } from 'node:process';
@@ -16,6 +16,12 @@ const options: ParseArgsOptionsConfig = {
     },
     tag: {
         type: 'string'
+    },
+    stage: {
+        type: 'string'
+    },
+    'dry-run': {
+        type: 'string'
     }
 };
 
@@ -80,44 +86,50 @@ function getChangedPackages(force: boolean) {
     return packages;
 }
 
-const DRY_RUN = process.env.DRY_RUN;
-function execDryRun(command: string, options: ExecSyncOptionsWithBufferEncoding) {
-    console.info(`executing command ${command} in ${options.cwd}`);
-    if (DRY_RUN) {
-        console.warn('nothing executed, dry run active');
-    } else {
-        execSync(command, options);
-    }
+function exec(command: string, cwd: string) {
+    console.info(`executing command ${command} in ${cwd}`);
+    execSync(command, { stdio: 'inherit', cwd });
 }
 
-function publish(platform: string, packages: Set<string>) {
+function publish(platform: string, packages: Set<string>, dryRun: boolean) {
     switch (platform) {
-        case 'web':
+        case 'web': {
+            const publishCommand = args.stage === 'true' ? 'npm stage publish' : 'npm publish';
+            // verbose logging surfaces the outcome of the OIDC token exchange
+            const dryRunArgs = dryRun ? ' --dry-run --loglevel verbose' : '';
             for (const packageName of packages) {
-                execDryRun(`npm publish --access public --tag ${args.tag}`, {
-                    stdio: 'inherit',
-                    cwd: resolve(import.meta.dirname, '../packages', packageName)
-                });
+                exec(
+                    `${publishCommand} --access public --tag ${args.tag}${dryRunArgs}`,
+                    resolve(import.meta.dirname, '../packages', packageName)
+                );
             }
             break;
-        case 'dotnet':
-            const dotnetPackages = ['AlphaTab', 'AlphaTab.Windows'];
-            for (const pkg of dotnetPackages) {
-                execDryRun(
-                    `dotnet nuget push ${pkg}/bin/Release/*.nupkg -k ${process.env.NUGET_API_KEY} -s https://api.nuget.org/v3/index.json`,
-                    {
-                        stdio: 'inherit',
-                        cwd: resolve(import.meta.dirname, '../packages/csharp/src')
+        }
+        case 'dotnet': {
+            const cwd = resolve(import.meta.dirname, '../packages/csharp/src');
+            for (const pkg of ['AlphaTab', 'AlphaTab.Windows']) {
+                if (dryRun) {
+                    // dotnet nuget push has no dry-run mode
+                    const nupkgs = readdirSync(resolve(cwd, pkg, 'bin/Release')).filter(f => f.endsWith('.nupkg'));
+                    if (nupkgs.length === 0) {
+                        throw new Error(`No nupkg found for ${pkg}`);
                     }
-                );
+                    console.info(`dry run, skipping push of ${pkg}:`, nupkgs);
+                } else {
+                    exec(
+                        `dotnet nuget push ${pkg}/bin/Release/*.nupkg -k ${process.env.NUGET_API_KEY} -s https://api.nuget.org/v3/index.json`,
+                        cwd
+                    );
+                }
             }
             break;
-        case 'kotlin':
-            execDryRun(`./gradlew publishToMavenCentral`, {
-                stdio: 'inherit',
-                cwd: resolve(import.meta.dirname, '../packages/kotlin/src/')
-            });
+        }
+        case 'kotlin': {
+            // DistPath is a local maven repository: builds and signs the publications without uploading them
+            const task = dryRun ? 'publishAllPublicationsToDistPathRepository' : 'publishToMavenCentral';
+            exec(`./gradlew ${task}`, resolve(import.meta.dirname, '../packages/kotlin/src/'));
             break;
+        }
     }
 }
 
@@ -180,7 +192,7 @@ switch (args.mode) {
         pack(args.platform as string, packages);
         break;
     case 'publish':
-        publish(args.platform as string, packages);
+        publish(args.platform as string, packages, args['dry-run'] === 'true');
         break;
     case 'check':
         check(args.platform as string, packages);