mcpField
N
node-release

node-release

github.com/paldomDevelopment140 installsUpdated 7w ago
Repository

About node-release

node-release is a skill for setting up automated versioning and npm publishing. It guides maintainers through release-tool selection, OIDC trusted publishing, first-publish setup, workflow configuration, and verification while avoiding long-lived registry secrets.

Key features

  1. 01Selects a release tool for workflow needs
  2. 02Guides OIDC trusted-publisher setup
  3. 03Covers first-publish bootstrap
  4. 04Provides publishing workflow guidance
  5. 05Verifies releases and provenance

Use cases

  1. 01Setting up automated npm releases
  2. 02Migrating publishing from stored tokens to OIDC
  3. 03Planning first publication of a new package
  4. 04Diagnosing release ordering and retry risks

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/paldom/node-skills --skill node-release

After installing, type/node-releasein Claude Code to confirm it loaded.

Bundled filesevals/evals.jsonreferences/release-playbook.md

Details

From the project README

node-release

Automates versioning and npm publishing with no long-lived secrets and no guessed facts. The failures this skill fixes: models wire NPM_TOKEN secrets in 2026, miss that a package's first version can't be published via OIDC, get the trusted-publisher registration subtly wrong (case, filename, indirection), and leave releases half-done when publish fails after tagging.

When NOT to use

  • Exports maps, bundling, tarball contents → node-packaging (release assumes its gates already pass).
  • Verifying dependencies' provenance → node-supply-chain.
  • Test/lint CI → node-ci.

Workflow

  1. Pick the release tool by workflow reality (decision table in references/release-playbook.md): Changesets (human-written notes, monorepos), semantic-release (strict conventional commits, fully autonomous), release-please (PR-gated review of each release).
  2. Trusted publishing (OIDC) — the default auth; all requirements are version-gated in the playbook with the official npm doc links (CLI/Node minimums on the runner, GitHub-hosted runners, exact repo + workflow-filename registration match, workflow_call indirection caveat). Provenance is attached automatically under trusted publishing.
  3. Bootstrap gotcha — say it before it bites: a brand-new package cannot be first-published via OIDC; the playbook's bootstrap procedure covers the one manual publish, then registration, then token revocation and account-level trusted-publishing-only enforcement.
  4. Write the publish workflow from the playbook's YAML: minimal permissions (id-token: write, contents: read/write only as needed), SHA-pinned third-party actions (consistent with node-supply-chain policy), publish gated on the node-packaging checks.
  5. Failure-ordering discipline: publish before tagging (or make retries idempotent); never delete published tags — releases are immutable.
  6. Verify end-to-end: dry-run, then a real publish of a prerelease/dist-tag where possible; confirm provenance on the registry page; only then revoke legacy tokens.

Output spec

A working automated release pipeline: version + changelog + tag + npm publish with provenance, zero long-lived registry secrets after cutover, bootstrap and rollback procedures documented in the repo, staged/prerelease channel decided deliberately.

Gotchas

  • Trusted-publisher registration is exact-match: owner/repo casing and workflow filename including extension; publishing from a reusable (workflow_call) workflow validates against the calling file.
  • OIDC does not make a compromised workflow safe — it removes stored-secret theft; workflow-file review still matters (CODEOWNERS on .github/).
  • Tag-then-fail leaves consumers seeing a version npm doesn't have — ordering or idempotency, pick one explicitly.
  • All npm-side specifics (minimums, staged publishing, token lifetimes) drift: the playbook version-gates each with its primary source — re-verify on setup.

Files

  • references/release-playbook.md — tool decision table, OIDC setup with version-gated requirements + doc links, bootstrap procedure, publish workflow YAML, failure-ordering patterns, dist-tag/prerelease guidance.

Comments

Markdown supported