Repository navigation
ci(publish): mirror releases to GitHub Packages - #8
Merged
Merged
Conversation
Adds a second Publish job that mirrors each new version to GitHub Packages, so the package and its versions show on the repo page alongside npm. GitHub Packages only accepts owner-scoped names, so the job renames the package to @lonetis/claudeleaf in the runner before publishing; the npm package stays `claudeleaf`. It authenticates with GITHUB_TOKEN (packages: write), and the existing `repository` field links the package to this repo. Like the npm job, it publishes only a version the registry does not have yet, so merging this backfills 0.3.1 there. Permissions move to job level: the npm job keeps id-token: write for trusted publishing; the GitHub Packages job gets packages: write and no id-token, so npm never attempts an OIDC exchange against GitHub's registry. It runs after the npm job, mirroring only a build that passed the tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015XnPdQXFWDT6FTnQs1d1f1
lonetis
marked this pull request as ready for review
October 20, 2026 13:06
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Mirrors each release to GitHub Packages, so the package and its versions show on the repo page (the Packages section of the sidebar) alongside npm.
A new
github-packagesjob inpublish.ymlruns after the npm job:npm pkg set name=@lonetis/claudeleafin the runner before publishing. The npm package staysclaudeleaf, and the installed command is stillclaudeleaf.GITHUB_TOKENwithpackages: write, so no secret is needed.setup-nodegetsscope: "@lonetis", which sends only that scope tonpm.pkg.github.com; dependencies still install from npmjs.repositoryfield added in ci(publish): publish via npm trusted publishing instead of NPM_TOKEN #6 links the package to this repo.needs: publish), so it only mirrors a build that passed the tests.Permissions are now set per job. The npm job keeps
id-token: writefor trusted publishing. The GitHub Packages job getspackages: writeand noid-token, so npm never tries trusted-publishing sign-in against GitHub's registry.CLAUDE.md's publishing section describes the mirror. npm stays the install source in the README, because GitHub Packages requires sign-in even to install public packages.Verification
actionlint1.7.7 reports no issues forpublish.ymlandci.yml.npm pack --dry-runproduces@lonetis/claudeleaf@0.3.1(lonetis-claudeleaf-0.3.1.tgz, 51 files), withbin.claudeleafandrepositoryunchanged.publish.yml. The first real run is the push tomainwhen this merges.After merging
Generated by Claude Code