Code reference detail
skip-already-published.mjs
scripts/skip-already-published.mjs
| Idea | Status | Tags | Summary | Katz |
|---|---|---|---|---|
| npm_distribution | in-progress | npm publishing runs only when a `language/v*`, `analytical/v*`, `cli/v*`, or `mcp/v*` tag is pushed. Tags are created by ["./distribution.rq".deployment_flow]; the npm workflow does not publish on ordinary commits. The workflow builds platform binaries when `@reqlan/analytical` was bumped ( `analytical/v*` tag, or `analytical_tag` from the release workflow ). It does not use `github.event_name == 'workflow_call'` for that gate: in a reusable workflow that name is the caller event ( `push` ), and `npm_ref` is the first language / analytical / cli / mcp tag, so a language bump would skip natives. It then publishes each package in sequence with `pnpm --filter <pkg> publish --access public --no-git-checks`. The sequence is language, then all platform packages for [native_targets], then `@reqlan/analytical`, then cli, then mcp. The workflow does not publish `@reqlan/analytical` until every platform package of that `@reqlan/analytical` version is on the npm registry or was published in the same job ( [rust_binary_distribution] ). ["../../scripts/require-natives-published.mjs"] enforces that gate from the analytical package. json version ( not Changesets ). Before each package publishes, ["../../scripts/skip-already-published.mjs"] with `--filter <pkg>` checks the public npm registry and skips that step when the version is already published ( sets `should_publish=false` ). That avoids re-attempting already-published versions under OIDC. Auth uses npm trusted publishing ( OIDC ) from GitHub Actions — no long-lived `NPM_TOKEN`. Workflow requirements: `permissions.id-token: write`, Node ≥ 22. 14 with npm ≥ 11. 5. 1, registry `https://registry.npmjs.org`. Each of `@reqlan/language`, `@reqlan/analytical`, `@reqlan/cli`, `@reqlan/mcp`, and every `@reqlan/analytical-<platform>-<arch>` platform package must have a Trusted Publisher on npmjs. com for GitHub Actions with org / user `littletuna4`, repository `reqlan`, workflow filename `deploy-npm.yml`, allowed action `npm publish`. Package `repository.url` must match `https://github.com/littletuna4/reqlan.git`. Provenance attestations are generated automatically for public packages from this public repo. Bootstrap: first publish of each scoped package can be done locally ( you must be logged in to npm as an `@reqlan` org member ) with `pnpm --filter @reqlan/language publish --access public --no-git-checks`, then platform packages, then analytical, then cli, then mcp — or wait for the trusted-publisher CI path after packages exist and Trusted Publisher is configured. Note: Packages must be `private: true` to skip local `changeset publish` ( `pnpm run release:npm` ), as with `reqlan-extension`. Platform packages are in the Changesets `ignore` list ( `@reqlan/analytical-*` ). Git `@reqlan/analytical` does not list them as `optionalDependencies`. ["../../scripts/prepare-native-packages.mjs"] `--publish-versions` writes pinned optionalDependencies for the npm checkout only. CI publishes platform packages per-package after binaries are built and does not use `changeset publish` for those tarballs. Published packages declare `publishConfig.access: public`. Trusted Publisher is configured on npmjs. com for each `@reqlan/analytical-<platform>-<arch>` package | 0.266 | |
| stopgap | Stopgap distribution is at https://marketplace.visualstudio.com/manage/publishers/reqlan | 0.040 |
Reference labels
"../../scripts/skip-already-published.mjs", ../../scripts/skip-already-published.mjs