Skip to content

docs(releasing): Homebrew tap step + npm --access public in the release checklist #126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oratis merged 1 commit into from
Jun 19, 2026
Merged

docs(releasing): Homebrew tap step + npm --access public in the release checklist #126

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 25 additions & 8 deletions docs/RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,18 @@ How to cut a new release that ships:
- Source + self-contained CLI bundles (Mac / Linux) via GitHub Releases
- **Lisa.app DMG** via GitHub Releases (this doc's focus — the Lisa Island
pill is built into Lisa.app, there's no separate LisaIsland.app anymore)
- The **Homebrew tap** formula (`oratis/homebrew-tap`)

There are three GitHub Actions workflows involved, all tag-triggered on `v*.*.*`:

| Workflow | Runner | Produces |
| Workflow / step | Trigger | Produces |
|---|---|---|
| `release.yml` | ubuntu-latest | source tarball, mac/linux CLI bundles |
| `release-mac-apps.yml` | macos-latest | `Lisa-Suite-vX.Y.Z.dmg` (Lisa.app) |
| (npm publish — manual) | local | npm package |
| `release.yml` | tag `v*.*.*` | source tarball, mac/linux CLI bundles |
| `release-mac-apps.yml` | tag `v*.*.*` | `Lisa-Suite-vX.Y.Z.dmg` (Lisa.app) |
| `npm publish` | manual (local) | npm package |
| `release-homebrew.yml` | manual (`workflow_dispatch`) | bumped `oratis/homebrew-tap` formula |

All three attach to the same `vX.Y.Z` GitHub Release.
The two tag-triggered workflows attach to the same `vX.Y.Z` GitHub Release. The
npm publish and Homebrew bump are manual and run *after* the tag (the tap formula
hashes the published npm tarball, so npm must go first).

---

Expand Down Expand Up @@ -51,9 +53,24 @@ All three attach to the same `vX.Y.Z` GitHub Release.
5. **Publish to npm** (manual)

```bash
npm publish
npm publish --access public
```

`--access public` is required: the package is scoped (`@oratis/lisa`), and
scoped packages default to *restricted* — without the flag npm 404s on the
`PUT`. `prepublishOnly` runs typecheck + test + build first.

6. **Bump the Homebrew tap** (manual — after npm publish lands on the registry)

```bash
gh workflow run "Release — Homebrew tap"
```

Pins `Formula/lisa.rb` in `oratis/homebrew-tap` to the freshly-published npm
tarball + its sha256. Needs the one-time `HOMEBREW_TAP_TOKEN` secret (and has a
manual fallback) — see [PUBLISH.md §2](PUBLISH.md). It must run *after* `npm
publish` because it hashes the real published tarball.

---

## Signing + notarization (optional but recommended)
Expand Down