From 1b0808373ced86f09bc02ede94ec9150b7997c77 Mon Sep 17 00:00:00 2001 From: Saatvik Arya Date: Wed, 26 Aug 2026 04:31:48 +0530 Subject: [PATCH 1/5] chore(publish): remove leftover Tegami publish lock The lock is from the 0.1.1 version PR. git and npm already match, so the first CI publish run should no-op instead of re-auditing a spent lock. --- .tegami/publish-lock.yaml | 49 --------------------------------------- 1 file changed, 49 deletions(-) delete mode 100644 .tegami/publish-lock.yaml diff --git a/.tegami/publish-lock.yaml b/.tegami/publish-lock.yaml deleted file mode 100644 index d5ba568..0000000 --- a/.tegami/publish-lock.yaml +++ /dev/null @@ -1,49 +0,0 @@ -core:changelogs: - - content: "---\npackages:\n \"@samva/better-auth\":\n type: patch\n---\n\n## Support Samva 0.3\n\nExpand the Samva peer dependency to support the current public email SDK.\n" - filename: 2026-08-26-better-auth-samva-03.md - v: 0.0.0 - - content: "---\npackages:\n \"@samva/email-sdk\":\n type: patch\n---\n\n## Support Samva 0.3\n\nExpand the Samva peer dependency to support the current public email SDK.\n" - filename: 2026-08-26-email-sdk-samva-03.md - v: 0.0.0 -core:packages: - - id: npm:clerk-webhook-samva - updated: false - - changelogIds: - - 2026-08-26-better-auth-samva-03.md - id: npm:@samva/better-auth - updated: true - - id: npm:react-email-samva - updated: false - - id: npm:sveltekit-transactional-samva - updated: false - - id: npm:supabase-auth-hook-samva - updated: false - - id: npm:effect-sdk-example - updated: false - - id: npm:hono-cloudflare-workers-samva - updated: false - - changelogIds: - - 2026-08-26-email-sdk-samva-03.md - id: npm:@samva/email-sdk - updated: true - - id: npm:better-auth-nextjs-samva - updated: false - - id: npm:tanstack-start-transactional-samva - updated: false - - id: npm:nextjs-transactional-samva - updated: false - - id: npm:astro-email-samva - updated: false -npm:packages: - - id: npm:clerk-webhook-samva - - id: npm:@samva/better-auth - - id: npm:react-email-samva - - id: npm:sveltekit-transactional-samva - - id: npm:supabase-auth-hook-samva - - id: npm:effect-sdk-example - - id: npm:hono-cloudflare-workers-samva - - id: npm:@samva/email-sdk - - id: npm:better-auth-nextjs-samva - - id: npm:tanstack-start-transactional-samva - - id: npm:nextjs-transactional-samva - - id: npm:astro-email-samva From d3d046aedd902e3e9541df1fcdb33f4edd0e22ef Mon Sep 17 00:00:00 2001 From: Saatvik Arya Date: Wed, 26 Aug 2026 04:31:48 +0530 Subject: [PATCH 2/5] ci: publish integration packages from GitHub Actions Run tegami ci on main with npm OIDC trusted publishing so releases no longer depend on a laptop npm login. --- .github/workflows/publish.yml | 43 +++++++++++++++++++++++++++++++++++ scripts/tegami.mts | 8 +++++-- 2 files changed, 49 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/publish.yml diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000..0ec66b5 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,43 @@ +name: Publish + +on: + push: + branches: + - main + +concurrency: + group: publish + cancel-in-progress: false + +jobs: + publish: + name: Version and publish + runs-on: ubuntu-latest + permissions: + contents: write + id-token: write + pull-requests: write + steps: + - name: Checkout + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + fetch-depth: 0 + + - name: Setup Bun + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 + with: + bun-version: 1.3.2 + + - name: Setup Node + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + with: + node-version: 24 + registry-url: https://registry.npmjs.org + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Version and publish packages + run: bun run tegami ci + env: + GITHUB_TOKEN: ${{ github.token }} diff --git a/scripts/tegami.mts b/scripts/tegami.mts index be2f40f..0c74e88 100644 --- a/scripts/tegami.mts +++ b/scripts/tegami.mts @@ -1,7 +1,7 @@ #!/usr/bin/env bun /** - * Attended release configuration for Samva integration packages. + * CI and local release config for Samva integration packages. * * Tegami owns changelogs, version pull requests, npm registry preflight, * dependency ordering, publication, Git tags, and GitHub Releases. Repository @@ -48,6 +48,10 @@ const paper = tegami({ npm: { client: "bun", updateLockFile: true, + trustedPublish: { + provider: "github", + workflow: "publish.yml", + }, onBreakPeerDep: "error", bumpDep: ({ dependent, kind }) => { if (dependent.manifest.private === true) return false; @@ -77,7 +81,7 @@ const paper = tegami({ versionPr: { branch: "tegami/version-packages", base: "main", - forceCreate: true, + forceCreate: false, create() { return { title: "chore(release): prepare integration packages" }; }, From 1d8f5ddd271ba9d053135c72eb582df828729459 Mon Sep 17 00:00:00 2001 From: Saatvik Arya Date: Wed, 26 Aug 2026 04:31:48 +0530 Subject: [PATCH 3/5] ci: add Tegami pull request release previews Split preview generation from commenting so untrusted PR code never gets a writable token. --- .github/workflows/tegami-pr-comment.yml | 47 +++++++++++++++++++++++++ .github/workflows/tegami-pr.yml | 40 +++++++++++++++++++++ 2 files changed, 87 insertions(+) create mode 100644 .github/workflows/tegami-pr-comment.yml create mode 100644 .github/workflows/tegami-pr.yml diff --git a/.github/workflows/tegami-pr-comment.yml b/.github/workflows/tegami-pr-comment.yml new file mode 100644 index 0000000..d9a32a2 --- /dev/null +++ b/.github/workflows/tegami-pr-comment.yml @@ -0,0 +1,47 @@ +name: Tegami PR Comment + +on: + workflow_run: + workflows: ["Tegami PR"] + types: [completed] + +permissions: + actions: read + contents: read + pull-requests: write + +jobs: + comment: + name: Post preview comment + if: > + github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.event == 'pull_request' + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + + - name: Setup Bun + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 + with: + bun-version: 1.3.2 + + - name: Setup Node + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + with: + node-version: 24 + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Download preview + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + with: + name: tegami-pr-preview + run-id: ${{ github.event.workflow_run.id }} + github-token: ${{ github.token }} + + - name: Post preview comment + run: bun run tegami pr comment tegami-pr-preview.md + env: + GITHUB_TOKEN: ${{ github.token }} diff --git a/.github/workflows/tegami-pr.yml b/.github/workflows/tegami-pr.yml new file mode 100644 index 0000000..67f4c10 --- /dev/null +++ b/.github/workflows/tegami-pr.yml @@ -0,0 +1,40 @@ +name: Tegami PR + +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: read + +jobs: + preview: + name: Release preview + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + fetch-depth: 0 + + - name: Setup Bun + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 + with: + bun-version: 1.3.2 + + - name: Setup Node + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + with: + node-version: 24 + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Release preview + run: bun run tegami pr preview --artifact tegami-pr-preview.md + + - name: Upload preview + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: tegami-pr-preview + path: tegami-pr-preview.md From 289dd9f3f722b6d2e47afe84071def89db1b7c77 Mon Sep 17 00:00:00 2001 From: Saatvik Arya Date: Wed, 26 Aug 2026 04:31:48 +0530 Subject: [PATCH 4/5] docs: document GitHub Actions as the npm publish path Describe tegami ci on main, trusted publishing, and keep laptop publish as emergency-only. This public repo expects npm provenance. --- CONTRIBUTING.md | 2 ++ README.md | 5 ++-- docs/releases.md | 74 ++++++++++++++++++++++++++++-------------------- 3 files changed, 49 insertions(+), 32 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 76c7e21..20b9e54 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -63,6 +63,8 @@ User-visible package changes also need a pending Tegami changelog under `.tegami/`. See [the release guide](./docs/releases.md) for the file format and package names. Commit the changelog with the implementation it describes; do not edit package `CHANGELOG.md` files or `.tegami/publish-lock.yaml` directly. +After the changelog reaches `main`, GitHub Actions opens the Version Packages +pull request. ## Proposing a new integration diff --git a/README.md b/README.md index f2aed72..9f77571 100644 --- a/README.md +++ b/README.md @@ -90,8 +90,9 @@ bun run format:check Contributions are welcome — see [CONTRIBUTING.md](./CONTRIBUTING.md) for local setup, package conventions, and how to propose a new integration. Maintainers -use the attended [Tegami release flow](./docs/releases.md) for package versions, -changelogs, npm publication, tags, and GitHub Releases. +use the [Tegami release flow](./docs/releases.md) for package versions, +changelogs, npm publication, tags, and GitHub Releases. GitHub Actions +publishes; merging the Version Packages pull request is the human gate. ## Security diff --git a/docs/releases.md b/docs/releases.md index 9347e15..d1c2ea6 100644 --- a/docs/releases.md +++ b/docs/releases.md @@ -2,13 +2,33 @@ This repository uses [Tegami](https://tegami.fuma-nama.dev) for changelogs, version pull requests, npm publication, Git tags, and GitHub Releases. -Releases are attended local sessions; GitHub Actions does not publish packages. + +GitHub Actions publishes the public packages. `.github/workflows/publish.yml` +runs `bun run tegami ci` on every push to `main`. That command versions first: +if `.tegami/` has pending changelog files, it opens or updates a Version +Packages pull request. If there is nothing to version, it publishes from +`.tegami/publish-lock.yaml`. Merging the Version Packages PR is the human gate; +the following `main` push publishes. Do not auto-merge that PR with +`GITHUB_TOKEN` — GitHub will not re-run workflows for commits created by that +token, so publish would never start. + +Authentication is npm trusted publishing (OIDC). The workflow sets +`id-token: write` and does not use an `NPM_TOKEN`. Each public package on +npmjs.com must list GitHub Actions trusted publisher +`AryaLabsHQ/samva-integrations` with workflow filename `publish.yml` and no +environment name. Do not rename `publish.yml`; npm pins that filename. + +This repository is public, so npm attaches provenance attestations to trusted +publishes. Current `0.1.1` tarballs were attended local publishes and have none. The public packages version independently: - `@samva/better-auth` — release group `better-auth` - `@samva/email-sdk` — release group `email-sdk` +Pull requests that add Tegami changelog files get a release preview comment +from the split `tegami-pr.yml` / `tegami-pr-comment.yml` workflows. + ## Queue a change Run `bun run tegami` to create a pending file under `.tegami/`, or write one as @@ -29,45 +49,39 @@ Use `@samva/better-auth`, `@samva/email-sdk`, `group:better-auth`, or `group:email-sdk` as the package key, with a `patch`, `minor`, or `major` bump. Commit the pending changelog with the user-visible change it describes. Do not edit package `CHANGELOG.md` files or `.tegami/publish-lock.yaml` directly. +After the changelog reaches `main`, Actions opens the Version Packages pull +request. -## Prepare the version pull request +## Version Packages pull request -Start from a clean, current `main` with GitHub CLI authentication: +Review the generated version bump, changelog aggregation, lockfile, and +`.tegami/publish-lock.yaml`. Merge it in the GitHub UI (or with a +non-`GITHUB_TOKEN` actor). The next `publish.yml` run publishes and creates +GitHub Releases. -```sh -bun install --frozen-lockfile -bun run version:packages -``` - -The version command passes the authenticated `gh` token to Tegami. Tegami -consumes pending changelogs, updates package versions and changelogs, refreshes -`bun.lock`, writes `.tegami/publish-lock.yaml`, pushes `tegami/version-packages`, -and opens or updates a pull request against `main`. Review and merge that pull -request before publishing. +`afterPreflight` still runs `bun run release:packages:check`: it builds each +canonical package root and audits the npm tarball. -## Publish - -From the clean, current merged `main`, authenticate npm and run the attended -release: +## Verify a publish ```sh -npm whoami -gh auth status -bun run release +gh run list --workflow=publish.yml --branch main --limit 5 +npm view @samva/better-auth version dist-tags --json +npm view @samva/email-sdk version dist-tags --json +gh release list --limit 10 ``` -The release command runs the full repository gates, passes the authenticated -`gh` token to Tegami, audits each canonical npm tarball, publishes planned -packages, then pushes group tags and creates matching GitHub Releases. +If a publish job fails partway through, fix the cause and re-run the same +workflow. The publish lock makes retries safe. + +## Emergency local publish -Verify the result for each affected package: +Use laptop publish only when Actions cannot. From a clean, current `main` with +npm 2FA: ```sh -npm view @samva/better-auth version dist-tags --json -npm view @samva/email-sdk version dist-tags --json -gh release list --limit 10 +npm whoami +GH_TOKEN="$(gh auth token)" bun run release ``` -Do not publish from a dirty worktree. If a release stops partway through, check -npm versions, Git tags, GitHub Releases, and Tegami publish status before -resuming or cleaning up the publish lock. +Restore CI as the default path after that emergency succeeds. From 3e00821138bc979cb3a88be0eb59d4eb6950745a Mon Sep 17 00:00:00 2001 From: Saatvik Arya Date: Wed, 26 Aug 2026 04:40:11 +0530 Subject: [PATCH 5/5] ci: isolate Tegami preview artifact from the comment workspace (greptile) Download the untrusted preview into RUNNER_TEMP so a fork cannot overwrite default-branch package.json before tegami pr comment runs with write tokens. --- .github/workflows/tegami-pr-comment.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/tegami-pr-comment.yml b/.github/workflows/tegami-pr-comment.yml index d9a32a2..235186a 100644 --- a/.github/workflows/tegami-pr-comment.yml +++ b/.github/workflows/tegami-pr-comment.yml @@ -38,10 +38,11 @@ jobs: uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: tegami-pr-preview + path: ${{ runner.temp }}/tegami-pr-preview run-id: ${{ github.event.workflow_run.id }} github-token: ${{ github.token }} - name: Post preview comment - run: bun run tegami pr comment tegami-pr-preview.md + run: bun run tegami pr comment "$RUNNER_TEMP/tegami-pr-preview/tegami-pr-preview.md" env: GITHUB_TOKEN: ${{ github.token }}