ci: auto-publish to npm when commits land on master

[Kikobeats]

What

Adds a release job to .github/workflows/main.yml so pushes to master publish automatically, replacing the manual pnpm release. Mirrors the tinyspawn workflow, adapted for this lerna monorepo.

How it works

• Gated on tests: release needs: [test], so it publishes only when every package's matrix leg is green.
• Publishes only when needed: runs the existing pnpm run release (lerna publish --conventional-commits), which bumps + publishes only packages with conventional-commit changes since their last tag.
• npm auth fix: pnpm now ignores the \${NPM_TOKEN} line in the committed .npmrc (it refuses to expand env vars in a committed project .npmrc). The release step writes the token to user-level config via pnpm config set so publish authenticates.
• Git push: checks out master with full history + GITHUB_TOKEN so lerna can push the changelog commit and version tags.

Loop prevention

lerna's chore(release): commit is pushed with GITHUB_TOKEN, which does not re-trigger on: push. Belt-and-suspenders: the test guard skips chore(release):/docs:/ci: commits, and a skipped test skips release through the needs chain.

Secrets required (org-level, same as tinyspawn)

NPM_TOKEN, GH_TOKEN, GIT_EMAIL, GIT_USERNAME — the existing contributors job already resolves the git ones, so they're present.

Note

The microlink.io (core) package currently has a flaky live-API integration test (video detects the primary video). Because release is gated on the full matrix, that test must be green for any package to publish. Worth stabilizing separately.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XZKpkLcBt4Z1t7Xronhet4

---

Note

Medium Risk
Release job publishes to npm and pushes version tags using secrets; incorrect gating or auth could block or mispublish, though it still depends on green test/lint and existing lerna behavior.

Overview
Adds automated npm publishing on pushes to master via a new release job that runs after test and lint, syncs master, re-runs the full test suite, configures npm auth with pnpm config set, and invokes the existing pnpm run release (lerna conventional publish). A workflow concurrency group (release-${{ github.ref }}, no cancel-in-progress) serializes release runs on the same ref.

Introduces a dedicated lint job (pnpm lint at repo root) in both main.yml and pull_request.yml (PR lint skipped on direct master pushes). Package scripts fold tsd into test (ava && tsd) and drop per-package lint / lint-from-pretest in core, function, and mql.

Unblocks the release gate by skipping the flaky live-API video detects the primary video integration test in packages/core with a TODO to re-enable when the API is stable.

^{Reviewed by Cursor Bugbot for commit 4b1214a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

@Kikobeats, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 17 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c4bbe699-dc38-4bfc-8c22-ac5e99805a4c

📥 Commits

Reviewing files that changed from the base of the PR and between 35ba2e5 and 4b1214a.

📒 Files selected for processing (6)

• .github/workflows/main.yml
• .github/workflows/pull_request.yml
• packages/core/package.json
• packages/core/test/integration.mjs
• packages/function/package.json
• packages/mql/package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/auto-release

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Kikobeats]

Good catch, fixed in a576dce. The race was real: the test matrix validated the trigger SHA, but the release job published master tip after git pull — those differ whenever contributors (or a concurrent push) advances master.

Fix mirrors the tinyspawn release job: the release job now runs pnpm test on the pulled tip immediately before pnpm run release, so only just-tested code ships. Pinning to the tested SHA instead isn't an option — lerna must be at master tip to push the changelog commit and tags. Also added a concurrency group (cancel-in-progress: false) so two release jobs can't run lerna publish simultaneously and race on tag pushes.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a576dce. Configure here.}

[Kikobeats]

Fixed in 32a0de1. You're right, and it was worse than a mismatch: root lint (standard + standard-markdown) runs nowhere in CI today — the matrix only does per-package tests — so my pnpm test made root lint a publish-time-only gate. Surprise failure post-merge.

Changed the release re-test to pnpm --recursive --sequential test, the same per-package tests the matrix validates (function/mql still lint+build via their own pretest), without adding the root lint as a release-only gate. Publish now gates on exactly what the PR/matrix already checked, just on the pulled tip.

[coveralls]

Coverage Report for CI Build 29997911105

Warning

No base build found for commit 35ba2e5 on master.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 76.925%

Details

• Patch coverage: No coverable lines changed in this PR.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	3656
Covered Lines:	2829
Line Coverage:	77.38%
Relevant Branches:	565
Covered Branches:	418
Branch Coverage:	73.98%
Branches in Coverage %:	Yes
Coverage Strength:	10.62 hits per line

---

💛 - Coveralls