From 6191504b6dda5ab02b8d2e4a48cc19b47abb0206 Mon Sep 17 00:00:00 2001 From: kokorolx Date: Sun, 6 Sep 2026 16:46:52 +0700 Subject: [PATCH 1/2] feat: publish as @img2threejs/plugin-character on npm --- .github/workflows/ci.yml | 17 +++++++++++++++++ .github/workflows/publish.yml | 23 +++++++++++++++++++++++ README.md | 8 ++++++++ package.json | 22 ++++++++++++++++++++++ 4 files changed, 70 insertions(+) create mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/publish.yml create mode 100644 package.json diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..c1b6b92 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,17 @@ +name: ci +on: + pull_request: + push: + branches: [main] +jobs: + version-sync: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - run: | + pkg=$(node -p "require('./package.json').version") + plg=$(node -p "require('./plugin.json').version") + if [ "$pkg" != "$plg" ]; then + echo "version mismatch: package.json=$pkg plugin.json=$plg" + exit 1 + fi diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000..62af6e6 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,23 @@ +name: publish +on: + push: + tags: ['v*'] +permissions: + contents: read + id-token: write +jobs: + publish: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: 24 + registry-url: https://registry.npmjs.org + - run: npm install -g npm@latest + - run: | + pkg=$(node -p "require('./package.json').version") + plg=$(node -p "require('./plugin.json').version") + [ "$pkg" = "$plg" ] || { echo "version mismatch: package.json=$pkg plugin.json=$plg"; exit 1; } + [ "v$pkg" = "$GITHUB_REF_NAME" ] || { echo "tag $GITHUB_REF_NAME != v$pkg"; exit 1; } + - run: npm publish --provenance --access public diff --git a/README.md b/README.md index c77bbc5..1759373 100644 --- a/README.md +++ b/README.md @@ -59,6 +59,14 @@ python3 -m unittest discover -s tests a frozen run on a real 113-node GLB. It is deliberately a byte comparison — a semantic assertion has to enumerate what matters, and the point of an oracle is to catch the change nobody predicted. +## Publishing to npm + +1. Bump the version in **both** `plugin.json` and `package.json` — CI's `version-sync` job fails the build if they disagree. +2. Update `CHANGELOG.md`. +3. Commit the bump. +4. Tag the commit `vX.Y.Z` (matching the new version) and push the tag. +5. The `publish` workflow picks up the tag, re-checks the version match, and runs `npm publish --provenance --access public` against `@img2threejs/plugin-character`. + ## Licence Apache-2.0. diff --git a/package.json b/package.json new file mode 100644 index 0000000..a310346 --- /dev/null +++ b/package.json @@ -0,0 +1,22 @@ +{ + "name": "@img2threejs/plugin-character", + "version": "0.2.0", + "description": "Character rigging and animation: skeleton from a GLB, skin conditioning, clip measurement, action design, and a twelve-check rig gate.", + "license": "Apache-2.0", + "repository": { + "type": "git", + "url": "git+https://github.com/img2threejs/plugin-character.git" + }, + "files": [ + "CHANGELOG.md", + "SKILL.md", + "domain.json", + "gates.json", + "plugin.json", + "reference", + "tools" + ], + "publishConfig": { + "access": "public" + } +} From 286f10b9b28fde2c5186cd52a42252da30b04416 Mon Sep 17 00:00:00 2001 From: kokorolx Date: Sun, 6 Sep 2026 17:07:32 +0700 Subject: [PATCH 2/2] feat: publish and test via the shared ci-workflows reusable workflows --- .github/workflows/ci.yml | 29 ++++++++++++++++++----------- .github/workflows/publish.yml | 32 +++++++++++++++++--------------- README.md | 9 ++++++--- 3 files changed, 41 insertions(+), 29 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c1b6b92..d73e188 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,15 +3,22 @@ on: pull_request: push: branches: [main] +permissions: + contents: read jobs: - version-sync: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - run: | - pkg=$(node -p "require('./package.json').version") - plg=$(node -p "require('./plugin.json').version") - if [ "$pkg" != "$plg" ]; then - echo "version mismatch: package.json=$pkg plugin.json=$plg" - exit 1 - fi + test: + # ci-workflows python-ci @ main + uses: img2threejs/ci-workflows/.github/workflows/python-ci.yml@4b7a0612d2c52815792124a18ae3f9032a4f0a88 + with: + python-version: '3.12' + test-command: | + pkg="$(node -p 'require("./package.json").version')" + plg="$(node -p 'require("./plugin.json").version')" + if [ "$pkg" != "$plg" ]; then + echo "version mismatch: package.json=$pkg plugin.json=$plg" + exit 1 + fi + git clone --depth 1 https://github.com/img2threejs/img2 ../img2-harness + mkdir -p ../img2home + ln -s "$(cd ../img2-harness && pwd)" ../img2home/harness + IMG2_HOME="$(cd ../img2home && pwd)" python3 -m unittest discover -s tests diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 62af6e6..943eea1 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -4,20 +4,22 @@ on: tags: ['v*'] permissions: contents: read - id-token: write jobs: publish: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 - with: - node-version: 24 - registry-url: https://registry.npmjs.org - - run: npm install -g npm@latest - - run: | - pkg=$(node -p "require('./package.json').version") - plg=$(node -p "require('./plugin.json').version") - [ "$pkg" = "$plg" ] || { echo "version mismatch: package.json=$pkg plugin.json=$plg"; exit 1; } - [ "v$pkg" = "$GITHUB_REF_NAME" ] || { echo "tag $GITHUB_REF_NAME != v$pkg"; exit 1; } - - run: npm publish --provenance --access public + # ci-workflows npm-publish (feat/reusable-npm-publish); re-pin to the merged main SHA once img2threejs/ci-workflows#2 lands + uses: img2threejs/ci-workflows/.github/workflows/npm-publish.yml@27da7a68505591492cb4ef7358968890c6e39844 + permissions: + contents: read + id-token: write + with: + tag: ${{ github.ref_name }} + version-file: plugin.json + node-version: '24' + python-version: '3.12' + test-command: | + git clone --depth 1 https://github.com/img2threejs/img2 ../img2-harness + mkdir -p ../img2home + ln -s "$(cd ../img2-harness && pwd)" ../img2home/harness + IMG2_HOME="$(cd ../img2home && pwd)" python3 -m unittest discover -s tests + secrets: + npm-token: ${{ secrets.NPM_TOKEN }} diff --git a/README.md b/README.md index 1759373..0d1fb5a 100644 --- a/README.md +++ b/README.md @@ -61,11 +61,14 @@ to enumerate what matters, and the point of an oracle is to catch the change nob ## Publishing to npm -1. Bump the version in **both** `plugin.json` and `package.json` — CI's `version-sync` job fails the build if they disagree. +CI and publishing run through the org's shared [`img2threejs/ci-workflows`](https://github.com/img2threejs/ci-workflows) reusable workflows; this repo owns only its triggers and its test command. + +1. Bump the version in **both** `plugin.json` and `package.json` — the `ci` workflow's version-sync check fails the build if they disagree. 2. Update `CHANGELOG.md`. 3. Commit the bump. -4. Tag the commit `vX.Y.Z` (matching the new version) and push the tag. -5. The `publish` workflow picks up the tag, re-checks the version match, and runs `npm publish --provenance --access public` against `@img2threejs/plugin-character`. +4. Tag the commit `vX.Y.Z` (matching the new version) and push the tag. A prerelease tag (`v1.2.3-beta.1`) publishes under the matching npm dist-tag (`beta`); a stable tag publishes under `latest`. +5. The shared `npm-publish.yml` workflow re-validates the tag against `package.json` and `plugin.json`, runs this repo's tests in a job with no access to the publish credential, and runs `npm publish --provenance` using the org's `NPM_TOKEN` secret (a granular npm automation token with publish rights on the `@img2threejs` scope, configured once at the org or repo level — no per-repo trusted-publisher setup needed). Re-pushing a tag whose version is already on the registry is a no-op, not a failure. +6. Workflow references in `.github/workflows/` are pinned to a specific `ci-workflows` commit SHA, per that repo's pinning policy. ## Licence