From 42fa0a1985f43f3f947b471fbd055c2659940742 Mon Sep 17 00:00:00 2001 From: Theo Ephraim Date: Wed, 27 May 2026 00:20:43 -0700 Subject: [PATCH 1/4] fix: disable npm staged publishing Staged publishing is not yet ready for production use. Removes npmStaged config and the npm upgrade step from the release workflow. --- .bumpy/_config.json | 3 +-- .bumpy/disable-staged-publishing.md | 5 +++++ .github/workflows/release.yaml | 1 - 3 files changed, 6 insertions(+), 3 deletions(-) create mode 100644 .bumpy/disable-staged-publishing.md diff --git a/.bumpy/_config.json b/.bumpy/_config.json index e6867d5..f141985 100644 --- a/.bumpy/_config.json +++ b/.bumpy/_config.json @@ -10,7 +10,6 @@ // narrows down which files are considered changes "changedFilePatterns": ["src/**", "skills/**", "package.json", "tsconfig.json", "tsdown.config.ts"], "publish": { - "provenance": true, - "npmStaged": true + "provenance": true } } diff --git a/.bumpy/disable-staged-publishing.md b/.bumpy/disable-staged-publishing.md new file mode 100644 index 0000000..6efc093 --- /dev/null +++ b/.bumpy/disable-staged-publishing.md @@ -0,0 +1,5 @@ +--- +'@varlock/bumpy': patch +--- + +Disable npm staged publishing — feature is not yet ready for production use. Removes `npmStaged` config and the npm upgrade step from the release workflow. diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 96ee3df..cb2c442 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -23,7 +23,6 @@ jobs: - uses: actions/setup-node@v6 with: node-version: latest - - run: npm install -g npm@latest # ensure npm >= 11.15.0 for staged publishing - run: bun install # --- You wont need this part --- From 2c26dbbfaaa85efeca41ee4bd68714be416027ab Mon Sep 17 00:00:00 2001 From: Theo Ephraim Date: Wed, 27 May 2026 00:23:25 -0700 Subject: [PATCH 2/4] fix: use BUMPY_GH_TOKEN for draft release operations The draft release functions (createDraftRelease, updateReleaseBody, finalizeRelease, deleteRelease) were not using withReleaseToken, so GitHub release events were created with GITHUB_TOKEN which doesn't trigger downstream workflows like on-release.yaml. --- .bumpy/disable-staged-publishing.md | 2 +- packages/bumpy/src/core/github-release.ts | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.bumpy/disable-staged-publishing.md b/.bumpy/disable-staged-publishing.md index 6efc093..6780b6f 100644 --- a/.bumpy/disable-staged-publishing.md +++ b/.bumpy/disable-staged-publishing.md @@ -2,4 +2,4 @@ '@varlock/bumpy': patch --- -Disable npm staged publishing — feature is not yet ready for production use. Removes `npmStaged` config and the npm upgrade step from the release workflow. +Disable npm staged publishing — feature is not yet ready for production use. Removes `npmStaged` config and the npm upgrade step from the release workflow. Also fix draft release functions (`createDraftRelease`, `updateReleaseBody`, `finalizeRelease`, `deleteRelease`) to use `BUMPY_GH_TOKEN` via `withReleaseToken` so that GitHub release events trigger downstream workflows. diff --git a/packages/bumpy/src/core/github-release.ts b/packages/bumpy/src/core/github-release.ts index 6f3dfbd..26b74ff 100644 --- a/packages/bumpy/src/core/github-release.ts +++ b/packages/bumpy/src/core/github-release.ts @@ -291,22 +291,22 @@ export async function createDraftRelease( ): Promise { const args = ['gh', 'release', 'create', tag, '--title', title, '--notes', body, '--draft']; if (targetSha) args.push('--target', targetSha); - await runArgsAsync(args, { cwd: rootDir }); + await withReleaseToken(() => runArgsAsync(args, { cwd: rootDir })); } /** Update an existing GitHub release's body */ export async function updateReleaseBody(tag: string, body: string, rootDir: string): Promise { - await runArgsAsync(['gh', 'release', 'edit', tag, '--notes', body], { cwd: rootDir }); + await withReleaseToken(() => runArgsAsync(['gh', 'release', 'edit', tag, '--notes', body], { cwd: rootDir })); } /** Finalize a draft release (remove draft status) */ export async function finalizeRelease(tag: string, rootDir: string): Promise { - await runArgsAsync(['gh', 'release', 'edit', tag, '--draft=false'], { cwd: rootDir }); + await withReleaseToken(() => runArgsAsync(['gh', 'release', 'edit', tag, '--draft=false'], { cwd: rootDir })); } /** Delete a GitHub release */ export async function deleteRelease(tag: string, rootDir: string): Promise { - await runArgsAsync(['gh', 'release', 'delete', tag, '--yes'], { cwd: rootDir }); + await withReleaseToken(() => runArgsAsync(['gh', 'release', 'delete', tag, '--yes'], { cwd: rootDir })); } /** Find draft releases for a package (by name prefix) that are older than the current version */ From 8e62b862e88c21158d4419b3d2621fb1cf6eb967 Mon Sep 17 00:00:00 2001 From: Theo Ephraim Date: Wed, 27 May 2026 00:24:35 -0700 Subject: [PATCH 3/4] chore: update bump file description --- .bumpy/disable-staged-publishing.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.bumpy/disable-staged-publishing.md b/.bumpy/disable-staged-publishing.md index 6780b6f..6d2b5e1 100644 --- a/.bumpy/disable-staged-publishing.md +++ b/.bumpy/disable-staged-publishing.md @@ -2,4 +2,4 @@ '@varlock/bumpy': patch --- -Disable npm staged publishing — feature is not yet ready for production use. Removes `npmStaged` config and the npm upgrade step from the release workflow. Also fix draft release functions (`createDraftRelease`, `updateReleaseBody`, `finalizeRelease`, `deleteRelease`) to use `BUMPY_GH_TOKEN` via `withReleaseToken` so that GitHub release events trigger downstream workflows. +Fix draft release functions (`createDraftRelease`, `updateReleaseBody`, `finalizeRelease`, `deleteRelease`) to use `BUMPY_GH_TOKEN` via `withReleaseToken` so that GitHub release events trigger downstream workflows. Also disables npm staged publishing (not yet ready) and removes the npm upgrade step from the release workflow. From 36b941b5d766f9a50a8546c13189adf8a1781ca8 Mon Sep 17 00:00:00 2001 From: Theo Ephraim Date: Wed, 27 May 2026 00:24:47 -0700 Subject: [PATCH 4/4] chore: rename bump file --- .../{disable-staged-publishing.md => fix-draft-release-token.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .bumpy/{disable-staged-publishing.md => fix-draft-release-token.md} (100%) diff --git a/.bumpy/disable-staged-publishing.md b/.bumpy/fix-draft-release-token.md similarity index 100% rename from .bumpy/disable-staged-publishing.md rename to .bumpy/fix-draft-release-token.md