1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
name: publish-npm
# Publishes the WASM package to npm via trusted publishing (OIDC) —
# the txcript package on npm trusts this repo + workflow filename, so
# no registry token is involved. Runs on version tags, with manual
# dispatch (on a tag ref) as the fallback. Guards that the tag matches
# package.json before publishing.
on:
push:
tags:
workflow_dispatch:
permissions:
contents: read
id-token: write
jobs:
npm:
name: Publish to npm
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: dtolnay/rust-toolchain@stable
with:
targets: wasm32-unknown-unknown
- uses: Swatinem/rust-cache@v2
- uses: taiki-e/install-action@v2
with:
tool: wasm-bindgen-cli@0.2.126
# The `build`/`prepare` scripts run through Bun; npm still invokes the
# `prepare` lifecycle during publish, so Bun must be on PATH.
- uses: oven-sh/setup-bun@v2
- uses: actions/setup-node@v4
with:
node-version: 24
registry-url: https://registry.npmjs.org
# Trusted publishing needs npm >= 11.5.1; Node 24 can bundle older.
- run: npm install -g npm@latest
- name: Tag matches package.json version
run: |
tag="${GITHUB_REF_NAME#v}"
ver="$(node -p "require('./package.json').version")"
echo "tag=$tag manifest=$ver"
[ "$tag" = "$ver" ] || { echo "::error::tag $tag != package.json version $ver"; exit 1; }
# Build the wasm artifact into pkg/, then publish via OIDC.
- run: bun run build
- run: npm publish --access public --ignore-scripts