中文
devexamples
← Workflows

阅读中文版本

Package Publishing Workflow

Build and test the package, bump the version with a changeset, publish with provenance to the registry, and verify installation from a clean environment.

intermediate~60 minreleasepackagingci

Objective

Publish a package to a registry safely with provenance and a post-publish verification.

Environment

  • A registry account with publishing rights
  • CI with provenance support

Steps

1. Run the full test and build

Run the full test and build for the package to publish.

Expected state: The artifact is tested before it leaves.

2. Bump the version deliberately and update

Bump the version deliberately and update the changelog.

Expected state: The version reflects the change.

3. Publish with provenance and two-factor auth

Publish with provenance and two-factor auth in CI.

Expected state: The package carries build provenance.

4. Install from a clean environment

Install from a clean environment and run a smoke import.

Expected state: The published package actually works.

Decision points

Publish manually or from CI?

  • CI with provenance
  • Manual local publish

CI with provenance; manual publishes lack verifiable build provenance and are error-prone.

Deprecate or unpublish a bad release?

  • Deprecate
  • Unpublish

Deprecate; unpublishing breaks consumers who depend on it and may violate registry policy.

Expected outcome

A tested, correctly versioned package published with provenance and verified by installing it into a clean environment.

Verification

Confirm the published version is installable, its provenance matches the CI build, and a smoke test imports and calls the package.

Cleanup

Tag the release and record the published version and provenance link.

Overview

Publish a package to a registry safely with provenance and a post-publish verification. Confirm the published version is installable, its provenance matches the CI build, and a smoke test imports and calls the package.

Steps

  1. Run the full test and build for the package to publish. Expected state: The artifact is tested before it leaves.
  2. Bump the version deliberately and update the changelog. Expected state: The version reflects the change.
  3. Publish with provenance and two-factor auth in CI. Expected state: The package carries build provenance.
  4. Install from a clean environment and run a smoke import. Expected state: The published package actually works.
npm publish --provenance --access public
# verify from a clean dir
mkdir /tmp/verify && cd /tmp/verify && npm init -y && npm i [email protected] && node -e "require('pkg')"

Verification

  • A tested, correctly versioned package published with provenance and verified by installing it into a clean environment.

Decision points

  • Publish manually or from CI? Options: CI with provenance; Manual local publish. Recommended: CI with provenance; manual publishes lack verifiable build provenance and are error-prone.
  • Deprecate or unpublish a bad release? Options: Deprecate; Unpublish. Recommended: Deprecate; unpublishing breaks consumers who depend on it and may violate registry policy.