Skip to content

ci(release): publish @nativescript/windows-napi with the runtimes - #39

Merged
triniwiz merged 2 commits into
mainfrom
ci/publish-windows-napi
Nov 6, 2026
Merged

triniwiz merged 2 commits into
mainfrom
ci/publish-windows-napi

Conversation

@triniwiz

@triniwiz triniwiz commented Nov 6, 2026 •

Copy link
Copy Markdown
Member

Summary

@nativescript/windows-napi has never been published. Its tag-triggered publish job in windows-napi.yml (windows-napi-v*) needed an NPM_TOKEN secret, and it ran npm publish without --tag, so a beta would have become latest. Beta.20 therefore went out without it.

With this PR the addon releases from npm_release.yml along with every other package, at the same version and dist-tag, using trusted publishing. It ships as one package that carries both binaries (windows.win32-x64-msvc.node and windows.win32-arm64-msvc.node, about 1.5 MB together). The generated loader already looks for a binary next to itself first, so there are no code changes. Compared with the napi-rs per-triple packages, this means one publish and one trusted publisher, and cross-arch app builds get both binaries. Per-arch packages can be revisited later.

  • scripts/resolve-release.mjs: napi is a regular package entry, also part of all. Its rust_targets are x64 and arm64; --skip-arm64 drops arm64.
  • npm_release.yml:
    • A "Build windows-napi" step runs napi build --platform --release --target <triple> for each target and checks there's one .node per target.
    • The normal Pack step packs both binaries, because files already includes windows.*.node.
    • Framework-only steps skip napi. The publish job is unchanged.
  • windows-napi.yml: keeps the PR build and test, and drops the tag trigger and publish job.
  • windows-napi package files:
    • Removed: npm/<triple>, optionalDependencies, and the artifacts and prepublishOnly scripts.
    • repository now points at NativeScript/windows, which --provenance requires.
    • package-lock.json now has the package's real name.
  • packages/README.md: describes the new flow.

Before the next release

  1. Publish @nativescript/[email protected] once by hand with --tag beta. Trusted publishing can only be configured on a package that already exists.
  2. On npmjs.com, add a trusted publisher to it: repository NativeScript/windows, workflow npm_release.yml, environment npm-publish.

Testing

  • node scripts/resolve-release.mjs with --engine napi, --engine napi --skip-arm64, and the default all: matrix, tarball names, dist-tags and targets come out as expected.
  • npm_release.yml parses (js-yaml), and npm ci passes in windows-napi with the updated lockfile.
  • Built both triples locally with the same commands and packed a single tarball containing both .node files. Installed in a clean project, it loads under Node, and the XAML suite passes 14/14 under electron.exe.
  • I haven't run the workflow itself. That only happens on a release dispatch or tag.

The addon had its own tag-triggered publish (windows-napi-v*) that was
never used: it needed an NPM_TOKEN secret and published prereleases
without a dist-tag. It now releases from npm_release.yml with every
other package, at the same version and dist-tag, via trusted publishing.

- resolve-release.mjs: `napi` (also part of `all`) adds three entries:
  the x64 and arm64 binary packages (kind napi-binding) and the JS root
  (kind napi-root). --skip-arm64 also drops the arm64 binary.
- npm_release.yml: napi-binding builds with `napi build --target` and
  copies windows.<triple>.node into its npm/<triple> package; napi-root
  pins its optionalDependencies to the release version. Framework-only
  steps are gated on kind == framework.
- windows-napi.yml keeps the PR build and test; its publish job and tag
  trigger are removed.
- package.json: repository points at NativeScript/windows (npm
  provenance requires it) in all three packages; prepublishOnly, which
  published the binary packages from the folder, is removed.
@coderabbitai

coderabbitai Bot commented Nov 6, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 5463eefe-c833-415d-9c7a-e37ad114f958

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

Replaces the napi-rs per-triple packages with a single
@nativescript/windows-napi that carries windows.win32-x64-msvc.node and
windows.win32-arm64-msvc.node. The generated loader already prefers a
binary next to it, so no code changes; one publish and one trusted
publisher instead of three, and cross-arch app builds get both binaries.

- resolve-release.mjs: `napi` is a regular package entry; it builds
  every rust_target (arm64 dropped with --skip-arm64).
- npm_release.yml: one "Build windows-napi" step runs `napi build
  --target` per triple; framework-only steps skip napi.
- Removes windows-napi/npm/<triple>, optionalDependencies and the
  `artifacts` script; package-lock.json gets the package's real name.
- packages/README.md describes the new flow.
@triniwiz
triniwiz merged commit a83567c into main Nov 6, 2026
3 checks passed
@triniwiz
triniwiz deleted the ci/publish-windows-napi branch November 6, 2026 05:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant