Repository navigation
Publish explicit numbered v1.0.0 alpha versions safely #385
Description
Part of #382 — v1.0.0 alpha readiness.
Problem
The current workflow starts from 0.1.0, appends -alpha-<commit>, and always publishes to alpha: .github/workflows/release.yml:57-L86. The LLM documentation independently constructs an alpha/hash version: docs/llm.js:145-L155.
The target is the 1.0.0-alpha.N series while ReScript 13 remains in alpha. A stable compiler and beta/stable publication are not prerequisites for this issue.
Acceptance criteria
- Choose one explicit source of truth for the release version, starting with
1.0.0-alpha.1(Git tagv1.0.0-alpha.1). - Keep package metadata, lockfile metadata where applicable, generated documentation, and release/tag instructions consistent with the chosen version.
- Validate that an alpha release version is published only to npm's
alphadist-tag; never advancelatestduring alpha publication. - Retain a non-publishing dry-run path for PRs/manual checks and retain the main-branch guard for real publication.
- Run formatting, build, feature, runtime, docs, and packed-consumer validation before publication.
- Dry-run the exact artifact intended for publishing; fail clearly on version/channel mismatch or already-published versions.
- Document tag/release-note/changelog steps, required publishing configuration, and how to verify the resulting dist-tag.
- Confirm provenance/trusted-publishing setup rather than assuming workflow YAML alone proves it works.
Boundaries
This issue implements and verifies release machinery. Closing it does not by itself authorize publishing a package. Do not broaden the alpha work into a full beta/stable promotion system unless explicitly chosen.
Release validation must incorporate #384 (actual tarball consumers) and #383 (reliable runtime checks).
Activity
jderochervlk commentedon Nov 5, 2026
Maintainer-only release gate identified during implementation: the agents can implement and review the workflow, but cannot confirm npm account-level trusted-publisher configuration from the workspace. This acceptance item remains unverified; no package has been published and no account settings have been changed.
Please inspect the Trusted Publisher section in the npm settings for
@rescript/webapiand confirm:rescript-langexperimental-rescript-webapirelease.yml— npm expects only the filename; the repository path is.github/workflows/release.yml.npm publishmust be permitted, not only staged publication. Standalone dist-tag-management permission is not needed unless the workflow actually uses it.The planned workflow restricts real publication to
refs/heads/main, requestsid-token: write, and uses npm provenance. Those code settings do not establish that npm trusts the workflow or prove a successful provenance-bearing publication. Actual published provenance must be checked after a separately authorized release.No credentials or tokens should be posted. A maintainer's confirmation of the configured identity is sufficient for the account-configuration check. Implementation and independent code review can proceed while this external gate remains open.
Reference: https://docs.npmjs.com/trusted-publishers/