Repository navigation
Publish scoped helper packages for appdmg release chain #16
Description
Goal
Publish or verify npm availability for the scoped packages needed before the first @appdmg/appdmg and @appdmg/cli releases can be validated from a clean install.
Requirements
- Verify npm auth for an account allowed to publish under the @appdmg scope.
- Publish or verify registry availability for @appdmg/bplist-creator, @appdmg/tn1150, @appdmg/macos-alias, and @appdmg/ds-store at the intended versions.
- Confirm @appdmg/appdmg resolves its scoped runtime dependencies from npm, not only GitHub tarballs or local paths.
- Confirm @appdmg/cli installs from a clean package with its exact @appdmg/appdmg dependency.
- Record the exact versions and dependency ranges used for the v1.0.0 release chain.
Current blocker
On 2026-04-30, local verification could not publish or inspect private auth because npm auth is unavailable from this machine:
- npm whoami: E401 Unauthorized
- @appdmg/bplist-creator: E404 on npm
- @appdmg/tn1150: E404 on npm
- @appdmg/ds-store: E404 on npm
- @appdmg/appdmg: E404 on npm
- @appdmg/cli: E404 on npm
- @appdmg/macos-alias is visible as 2.0.0, but the Node.js 24 modernization needs the intended release version to be verified before final publication.
Acceptance criteria
- A clean npm install can resolve the full @appdmg release chain.
- npm package metadata and versions are recorded in the release notes.
- The final CLI package can be packed and installed without GitHub tarball dependencies.
Activity
jozefizso commentedon May 2, 2026
Publish workflow infrastructure is now merged across the release chain:
Each workflow runs from GitHub Actions release events, uses Node.js 24, grants id-token permissions, packs the exact npm tarball, creates a GitHub artifact attestation for that tarball, uploads it as a workflow artifact, and publishes the same tarball with
npm publish --provenance --access public.Remaining setup before release: configure npm Trusted Publishers for each package using workflow filename
publish.ymland no environment name. If npm cannot configure Trusted Publishing before a first publish for a new package, add a granularNPM_TOKENrepository secret temporarily; the workflows still publish from Actions with provenance enabled. Release order remains bottom-up: bplist-creator, tn1150, macos-alias, ds-store, then appdmg/appdmg-cli.