[kristoferlund]

TECH-818. Prepares the release workflow to publish @hypercerts-org/api to npm, modelled on the lexicon repository's release workflow so the lexicon, API and (later) SDK repositories release the same way.

What changes

• Release Bot app token for the Release PR and the publish step, as in the lexicon repository. A Release PR opened with GITHUB_TOKEN does not trigger CI.
• npm Trusted Publishing with provenance (id-token: write, NPM_CONFIG_PROVENANCE). The repository holds no npm token. changeset publish runs pnpm publish, which on pnpm 10 hands the tarball to the npm CLI bundled with Node 24, new enough for Trusted Publishing.
• The tag and GitHub Release check covers every released package, not only the server modules. Before, a release that bumped only @hypercerts-org/api would have found the modules' tag, set publish=false and released nothing. It still fails on an inconsistent tag or release, per package.
• Neutral names: "Release packages" instead of "Release API bundle".
• Docs: .changeset/README.md describes both packages; packages/api/README.md describes the release path and how to start releasing; the changesets skill notes the second package.

@hypercerts-org/happyview-modules stays private: tag and GitHub Release only, never npm. @hypercerts-org/api stays private and in the Changesets ignore list, so merging this releases nothing new. It is switched on in the pull request that moves it to the published lexicon package (2.0, hypercerts-lexicon#270).

Before merging

• Release Bot secrets: the hypercerts-release-bot app is installed on every repository in the org, and RELEASE_BOT_APP_ID and RELEASE_BOT_APP_PRIVATE_KEY are now organization secrets shared with api and sdk (2026-11-02). hypercerts-lexicon keeps its own repository secrets.

Before the first npm release (later)

• Configure a Trusted Publisher for @hypercerts-org/api on npmjs.com (repository hypercerts-org/api, workflow release.yml). If npm requires the package to exist first, an owner of the @hypercerts-org scope publishes the first version by hand.

Not tested end to end: the publish job only runs when a Release PR is merged. The YAML parses, and the package-list step was run locally.

Confidence Score: 5/5

The PR appears safe to merge once the acknowledged Release Bot setup is complete.

Summary

Prepares the release workflow to release packages independently and publish @hypercerts-org/api to npm once it is enabled.

• Release PRs use the Release Bot identity.
• Release checks cover each eligible package version.

No actionable issues were found. Publication was not tested end to end.

Acknowledged setup and intentional behavior:

• kristoferlund acknowledges that the Release Bot app must be installed and its secrets added before merging.
• kristoferlund defers enabling @hypercerts-org/api until it uses the published lexicon package and npm Trusted Publishing is configured.
• Blocking on inconsistent tags and GitHub Releases is explicitly intentional.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Push to main] --> B[Select Changesets mode]
  B --> C[Release Bot creates or updates Release PR]
  C --> D[Release PR merged]
  D --> E[Check and build packages]
  E --> F[Check tags and GitHub Releases for non-ignored packages]
  F --> G{Release state}
  G -->|All already released| H[Skip publishing]
  G -->|Any version is new| I[Run Changesets publish]
  G -->|Tag and release disagree| J[Stop with an error]

Loading

_{Reviews (1) · Last reviewed commit: "release: publish to npm with Trusted Pub..." · Reviewed by Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
api-endpoints	Ready	Preview	Nov 2, 2026 10:27am UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: eedf08b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d5a4073f-58f9-4286-aef9-e28053e45bb6

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud