From 0f053d074e61c0fd670222f380ff71f9e5a61e78 Mon Sep 17 00:00:00 2001 From: Gabriel Mule Date: Mon, 19 Oct 2026 20:32:30 -0300 Subject: [PATCH 1/4] ci: move checkout and setup-node to v5 v4 of both actions runs on Node.js 20, which GitHub Actions flags as deprecated on every run. v5 runs on Node 24 and keeps the inputs used here (node-version, registry-url). setup-node v5's automatic caching only applies with a packageManager field in package.json, which this package does not have, so behavior is unchanged. --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/publish.yml | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a05d747..9d796d3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,14 +20,14 @@ jobs: name: bun runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 - uses: oven-sh/setup-bun@v2 with: bun-version: latest # `npm ci` rather than `bun install`, deliberately: one lockfile decides # the toolchain version on every runtime, so a Bun-only resolution can # never be the reason this job disagrees with the Node ones. - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v5 with: node-version: 24 - run: npm ci @@ -53,8 +53,8 @@ jobs: # 2026-04-30 and is deliberately not here. node: [22, 24] steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v5 + - uses: actions/setup-node@v5 with: node-version: ${{ matrix.node }} - run: npm ci diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a46e371..81ad228 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -34,8 +34,8 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v5 + - uses: actions/setup-node@v5 with: node-version: 24 registry-url: https://registry.npmjs.org From e6d3b8ee8a99f624f23058ee7ee1ff032bcdef12 Mon Sep 17 00:00:00 2001 From: Gabriel Mule Date: Mon, 19 Oct 2026 20:33:36 -0300 Subject: [PATCH 2/4] ci: move checkout and setup-node to v7 Latest majors of both. Inputs used here (node-version, registry-url) are unchanged. setup-node v7 no longer exports a dummy NODE_AUTH_TOKEN; Trusted Publishing does not use it, and npm 11 reads the generated .npmrc with the variable unset. Automatic caching (npm only since v6) still needs a packageManager field, which package.json does not have. --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/publish.yml | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9d796d3..764f0d1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,14 +20,14 @@ jobs: name: bun runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - uses: oven-sh/setup-bun@v2 with: bun-version: latest # `npm ci` rather than `bun install`, deliberately: one lockfile decides # the toolchain version on every runtime, so a Bun-only resolution can # never be the reason this job disagrees with the Node ones. - - uses: actions/setup-node@v5 + - uses: actions/setup-node@v7 with: node-version: 24 - run: npm ci @@ -53,8 +53,8 @@ jobs: # 2026-04-30 and is deliberately not here. node: [22, 24] steps: - - uses: actions/checkout@v5 - - uses: actions/setup-node@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: ${{ matrix.node }} - run: npm ci diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 81ad228..1b88128 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -34,8 +34,8 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@v5 - - uses: actions/setup-node@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 24 registry-url: https://registry.npmjs.org From 4e3bc1b271ad26a7dd98e47acc53b72e230529ec Mon Sep 17 00:00:00 2001 From: Gabriel Mule Date: Mon, 19 Oct 2026 20:33:53 -0300 Subject: [PATCH 3/4] docs: trusted publisher validated; explain the 0.0.0-stage placeholder --- RELEASING.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/RELEASING.md b/RELEASING.md index 7aa91bb..f854ce1 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -87,7 +87,7 @@ publishes for real. | --- | --- | --- | | `the-coded` organisation on npmjs.com, owning the `@the-coded` scope | npmjs.com | done | | First version published by hand (npm only allows a trusted publisher on a package that already exists) | local, logged in with 2FA | done: `0.1.0`, 2026-10-19 | -| Trusted publisher: GitHub Actions, organisation `the-coded`, repository `llm-adapters`, workflow `publish.yml`, environment `npm`, with direct `npm publish` allowed | npmjs.com → package → Settings | done 2026-10-19; **pending validation**: npm needs one publish from the workflow before 2026-10-21 23:20 UTC | +| Trusted publisher: GitHub Actions, organisation `the-coded`, repository `llm-adapters`, workflow `publish.yml`, environment `npm`, with direct `npm publish` allowed | npmjs.com → package → Settings | done 2026-10-19; **valid** since the first workflow publish (`0.1.1-beta.0`, 2026-10-19) | | GitHub environment named `npm` | GitHub → repository → Settings → Environments | done 2026-10-19 | | Tag and GitHub Release `v0.1.0` on the commit that was published (`5d7edf8`) | GitHub | done 2026-10-19 (the publish run it triggered was cancelled; see below) | @@ -102,6 +102,16 @@ always runs the workflow, and for a version already on npm it would fail at Release after the fact (as done for `v0.1.0`), publish it and cancel the `publish` run it triggers: `gh run cancel `. +**The `0.0.0-stage` placeholder.** When a package that does not exist yet is +staged with `npm stage publish`, npm publishes a public placeholder version, +`0.0.0-stage`, whose README reads "Temporary Holding Version" (see npm's +[staged publishing docs](https://docs.npmjs.com/staged-publishing/)). This +package got one on its first publish. To remove it: `npm stage list +@the-coded/llm-adapters` and `npm stage reject ` for anything still pending, +then `npm unpublish @the-coded/llm-adapters@0.0.0-stage`, ideally within 72 hours +of the package's creation ([unpublish policy](https://docs.npmjs.com/policies/unpublish/)). +Unpublishing one version does not block later publishes. + ## When something goes wrong | Symptom | Cause | Fix | From 0ecff670977125198cb2218cafbb71fa1cf492bb Mon Sep 17 00:00:00 2001 From: Gabriel Mule Date: Mon, 19 Oct 2026 20:35:17 -0300 Subject: [PATCH 4/4] docs: source the npm stage commands and their npm version --- RELEASING.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/RELEASING.md b/RELEASING.md index f854ce1..8d8e8d6 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -104,11 +104,13 @@ Release after the fact (as done for `v0.1.0`), publish it and cancel the **The `0.0.0-stage` placeholder.** When a package that does not exist yet is staged with `npm stage publish`, npm publishes a public placeholder version, -`0.0.0-stage`, whose README reads "Temporary Holding Version" (see npm's -[staged publishing docs](https://docs.npmjs.com/staged-publishing/)). This -package got one on its first publish. To remove it: `npm stage list -@the-coded/llm-adapters` and `npm stage reject ` for anything still pending, -then `npm unpublish @the-coded/llm-adapters@0.0.0-stage`, ideally within 72 hours +`0.0.0-stage` (see npm's +[staged publishing docs](https://docs.npmjs.com/staged-publishing/)); on the +package page its README reads "Temporary Holding Version". This package got one +on its first publish. To remove it, with npm 11.15 or newer (`npm stage` does +not exist before; [command reference](https://docs.npmjs.com/cli/v11/commands/npm-stage/)): +`npm stage list @the-coded/llm-adapters` and `npm stage reject ` for +anything still pending, then `npm unpublish @the-coded/llm-adapters@0.0.0-stage`, ideally within 72 hours of the package's creation ([unpublish policy](https://docs.npmjs.com/policies/unpublish/)). Unpublishing one version does not block later publishes.