Merged
Conversation
Ensures every tarball — whether from `npm publish`, `npm pack`, or a consumer installing from a git URL — is built fresh from source, regardless of who runs the command. Moves the build guarantee out of the Makefile and any CI workflow and into package.json itself.
Now that prepack guarantees a fresh build for every tarball — whether from `npm publish`, `npm pack`, or a consumer installing from a git URL — a committed `dist/` is redundant. Removing it eliminates noisy diffs and the merge conflicts that come from regenerating build output on every change.
The denylist would allow any new top-level file or directory to be included in published tarballs by default. Switching to an allowlist makes the published surface explicit and structurally prevents leaks of unrelated local files. The allowlist preserves prior behavior: `dist/`, `CHANGELOG.md`, and the npm-implicit `README.md` and `package.json`.
Its `build` target (`rm -rf dist && npm run build`) now lives in the package.json `prepack` script, and its `test` target was a thin wrapper around `npm test`. The Makefile no longer carries unique behavior.
Without an `engines` declaration, the package made no claim about runtime support and would install silently on any Node version. CI currently tests against Node 20 and 21, so `>=20` codifies the existing supported floor. Consumers on older Node versions will now get an `EBADENGINE` warning at install time.
timriley
added a commit
to hanakai-rb/release-machine
that referenced
this pull request
Apr 19, 2026
Create a new `release-npm.yml` workflow, which we can use for releasing hanami-assets to npm in the same way we release our gems, which includes the automatic GitHub release creation and post to our forum. This uses npm trusted publishing, which I've already configured for our Hanami-assets package. Common logic between the existing release.yml and our new release-npm.yml has been extracted into separate shared actions. This approach is facilitated by the changes in hanami/hanami-assets-js#43, which ensure all the necessary publishing-related steps are encapsulated within hanami-assets' `package.json`, so the release workflow here can just call `npm publish` and nothing else.
cllns
added a commit
to hanami/hanami
that referenced
this pull request
Apr 19, 2026
Fix for: hanami/hanami-assets-js#43 Testing here, then will put in repo-sync once it's correct
This was referenced Apr 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tighten up packaging and release hygiene ahead of adopting the npm trusted publishing workflow (using release-machine to publish this package) . The goal is to move publishing guarantees into
package.jsonitself so the published tarball is correct and reproducible regardless of who runsnpm publish— CI, a maintainer, or a consumer installing from a git URL.Changes
prepackscript — runsclean && buildbefore any tarball is produced (npm publish,npm pack, or git-URL install). The build guarantee no longer depends on remembering to run a Makefile target or wire a CI step.filesallowlist replaces.npmignore— an allowlist makes the published files explicit and will prevent leaking of unrelated local files.dist/removed from git — now thatprepackalways rebuilds, the trackeddist/was redundant noise that produced merge conflicts on every source change.dist/is now in.gitignore.Makefiledeleted — itsbuildtarget lives inprepack, andtestwas a thin wrapper aroundnpm test. CI updated to callnpm testdirectly.enginesfield — declaresnode: ">=20", matching the current CI floor, so installs on older Node versions get anEBADENGINEwarning instead of silently proceeding.Verification
npm pack --dry-runproduces the expected tarball:dist/,CHANGELOG.md,README.md,package.json— and nothing else.rm -rf distproduces an identical file listing, confirmingprepackrebuilds from source.npm testpasses locally and CI no longer references the removed Makefile.