chore(release): phase 2 – enable publish via changesets action, add release script, remove legacy release-publish workflow

.github/workflows/release-prepare.yml

@@ -35,13 +35,13 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
 
-      # Opens/updates the Version Packages PR; no publishing here
+      # Opens/updates the Version Packages PR; publishes when the Version PR merges
       - name: Create/Update Version PR
         uses: changesets/action@v1
         with:
           title: 'chore(release): version packages'
           createGithubReleases: true
-          publish: "echo 'Dry run: changeset publish would execute here'"
+          publish: pnpm run release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/release-publish.yml

@@ -1,72 +0,0 @@
-name: Publish to npm
-
-on:
-  release:
-    types: [published]
-  workflow_dispatch: {}
-
-permissions:
-  contents: read
-  id-token: write
-
-concurrency:
-  group: publish-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    env:
-      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'pnpm'
-          registry-url: 'https://registry.npmjs.org'
-          scope: '@fission-ai'
-          always-auth: true
-
-      - run: pnpm install --frozen-lockfile
-      
-      - name: Build project
-        run: pnpm run build
-
-      - name: Ensure running from a tag
-        run: |
-          if [[ "$GITHUB_REF" != refs/tags/* ]]; then
-            echo "This workflow must run from a tag (got: $GITHUB_REF)";
-            exit 1;
-          fi
-
-      - name: Verify release tag matches package.json
-        run: |
-          TAG="${GITHUB_REF_NAME#v}"
-          PKG_VERSION=$(node -p "require('./package.json').version")
-          if [ "$TAG" != "$PKG_VERSION" ]; then
-            echo "Tag v$TAG does not match package.json $PKG_VERSION"; exit 1
-          fi
-
-      - name: Debug npm auth and context
-        run: |
-          test -n "$NODE_AUTH_TOKEN" || (echo "NODE_AUTH_TOKEN is missing" && exit 1)
-          echo "NODE_AUTH_TOKEN present"
-          npm --version
-          pnpm --version
-          node --version
-          npm config get registry
-          npm whoami
-          npm ping
-
-      - run: pnpm test
-
-      - name: Publish
-        run: pnpm publish --access public --provenance --no-git-checks

package.json

@@ -46,6 +46,7 @@
     "test:coverage": "vitest --coverage",
     "prepare": "pnpm run build",
     "prepublishOnly": "pnpm run build",
+    "release": "pnpm run build && pnpm exec changeset publish",
     "changeset": "changeset"
   },
   "engines": {