[XELP] Publish releases to GitHub Packages by ljunkie · Pull Request #4 · plexinc/brighterscript-formatter

ljunkie · 2026-08-28T02:37:24Z

Adds xelp_npm_release.yml, which builds xelp/main and publishes it to GitHub Packages
as @plexinc/brighterscript-formatter, replacing the xelp/dist git tag release. It
authenticates with the built in GITHUB_TOKEN, so there is no publishing secret to store
in this repo.

Also points the brighterscript dependency at @plexinc/brighterscript, already published
from that repo, so installing this package no longer clones a git repo. The range is a
caret on the minor rather than an exact pin, so it dedupes onto whatever 0.70 build the
consuming project pins: two copies of brighterscript in one tree would break the plugin
instanceof checks bsc relies on. The swap was made with a targeted npm install, which
changed one lockfile entry out of 553, rather than by regenerating the lockfile.

xelp_shadow_release.yml is renamed to .disabled rather than deleted, since both
workflows derive the same version and would fight over the same tag. Restoring it is a
rename, and it is a separate commit so it can be reverted on its own.

A workflow_dispatch workflow is only dispatchable from the default branch, so the first
run happens after this merges. Run it with dryRun: true first, which builds, lints, tests
and packs without publishing.

Replace the git tag and xelp/dist shadow release with a workflow that publishes to GitHub Packages as @plexinc/<name>, matching how the other Plex client repos consume private packages. Authentication is the workflow GITHUB_TOKEN, so the repository stores no publishing secret, and the package name is rewritten in CI rather than on xelp/main, leaving upstream merges unaffected. The lint and test suites previously ran as a side effect of npm version, which triggers preversion. Setting the version with npm pkg set skips lifecycle scripts, so they now run as their own steps. Consumers keep the upstream package name by installing through an npm alias, so imports, bin names and plugin references do not change.

Both workflows compute the same MAJOR.MINOR.<date><PATCH> version and so want the same tag, and the shadow release force pushes it, so running the two against one commit means one clobbers the other. Park the shadow release rather than delete it, matching the .disabled convention already used in this repo, so restoring it is a rename. roku-client is the only consumer of this fork, and it keeps installing from the existing git tag until it moves to the @plexinc package, so nothing depends on this workflow staying runnable in the meantime.

Point the runtime dependency at the GitHub Packages release rather than a git tag, so installing this package no longer clones the brighterscript repo and consumers no longer need SSH access to GitHub to resolve it. The .npmrc tells npm where the @plexinc scope lives, matching the other Plex client repos. The range is a caret on the minor rather than an exact pin, so it dedupes onto whatever 0.70 build the consuming project pins. Two copies of brighterscript in one tree would break the plugin instanceof checks that bsc relies on. The swap was made with a targeted npm install rather than by regenerating the lockfile, which changed one entry out of 553. A clean re-resolve floats vscode-languageserver-protocol onto a release that ships exports with no main or types entry, and the TypeScript build cannot import it.

Copilot

Pull request overview

This PR migrates the XELP release mechanism from a git-tag/xelp/dist-based “shadow release” to publishing the built artifact as an npm package in GitHub Packages, and updates dependencies to consume internal @plexinc/* packages via the registry.

Changes:

Switch brighterscript dependency from a git URL to an npm alias pointing at @plexinc/brighterscript@^0.70.0.
Add a new workflow_dispatch workflow to build xelp/main, publish to GitHub Packages, tag, and create a prerelease.
Add repo .npmrc for @plexinc registry routing and keep the prior shadow release workflow present but renamed to .disabled.

Reviewed changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
package.json	Updates `brighterscript` dependency to an npm alias for `@plexinc/brighterscript`.
package-lock.json	Locks `brighterscript` to the GitHub Packages tarball and updates dependency source metadata.
.npmrc	Routes `@plexinc` scope to GitHub Packages (registry configuration).
.github/workflows/xelp_shadow_release.yml.disabled	Preserves the old shadow release workflow in a disabled state.
.github/workflows/xelp_npm_release.yml	Adds the new GitHub Packages publish/tag/release workflow for `xelp/main`.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+# Use GitHub for @plexinc packages.
+@plexinc:registry=https://npm.pkg.github.com/
+//npm.pkg.github.com/:always-auth=true


The build workflow runs npm ci, and this package now depends on @plexinc/brighterscript from GitHub Packages, so the install needs a token. Without it the job fails with a 401 before it gets as far as compiling. setup-node points the @plexinc scope at the registry and the token is given only to the install step, which is the only step here that reaches the network.

The token was on the job, which put it in the environment of every step, including any added later. It is only needed by the three steps that talk to the registry: the published version check, the install, and the publish. Building, linting, testing and packing do not reach the network. A step that runs npm against the registry has to opt in from now on, which is easy to forget, so the reason is written next to the first one.

Copilot

Pull request overview

Copilot reviewed 4 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

.github/workflows/build.yml:30

This workflow still uses floating action refs (actions/checkout@master, actions/setup-node@master). Because this PR adds GitHub Packages configuration to setup-node, leaving the action pinned to a moving branch creates supply-chain risk and can introduce unexpected CI breakages when the upstream master changes. Pin both actions to a stable major tag (or a commit SHA).

      - uses: actions/setup-node@master
        with:
          node-version: "22"
          architecture: 'x64' # fix for macos-latest
          registry-url: 'https://npm.pkg.github.com'

.github/workflows/xelp_npm_release.yml:152

npm publish will run the package's lifecycle scripts (including prepublishOnly), which in this repo already executes build, test, and lint. Since this workflow explicitly runs Build/Lint/Test earlier, the publish step will repeat those tasks, increasing runtime and adding a second chance for flaky failures. If the earlier steps are intended to be the gate, publish with --ignore-scripts to avoid re-running them.

      - name: Publish to GitHub Packages
        if: ${{ !inputs.dryRun }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npm publish

Copilot

Pull request overview

Copilot reviewed 4 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/build.yml:30

This workflow now relies on actions/setup-node for GitHub Packages registry configuration (registry-url/scope). Using a mutable ref (@master) makes CI behavior non-reproducible and can break unexpectedly if the action changes; pinning to a stable major tag is safer.

      - uses: actions/setup-node@master
        with:
          node-version: "22"
          architecture: 'x64' # fix for macos-latest
          registry-url: 'https://npm.pkg.github.com'

Copilot

Pull request overview

Copilot reviewed 4 out of 6 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

.github/workflows/xelp_npm_release.yml:36

runs-on: blacksmith-2vcpu-ubuntu-2404 is the only runner label used in this repo’s workflows; if that runner group isn’t available in this repository/org, this release workflow will never start. Consider using a standard GitHub-hosted runner label (or documenting/enforcing the required runner group).

    runs-on: blacksmith-2vcpu-ubuntu-2404

.github/workflows/build.yml:30

This workflow still references mutable action refs (actions/checkout@master, actions/setup-node@master). Since this change adds registry configuration and token usage, it’s a good point to pin these actions to a stable major version (consistent with xelp_shadow_release.yml.disabled, which uses @v4) to reduce supply-chain and breakage risk.

      - uses: actions/setup-node@master
        with:
          node-version: "22"
          architecture: 'x64' # fix for macos-latest
          registry-url: 'https://npm.pkg.github.com'

A repository's own GITHUB_TOKEN cannot read a package owned by another repository, so npm ci fails with a 403 on @plexinc/brighterscript. GH_TOKEN is the token the other Plex client repos already use for this. Only the install steps change. The published version check and the publish act on this repository's own package, where GITHUB_TOKEN is correct and already works. The fallback keeps a fork that has no @plexinc dependencies working on the repo token alone.

Copilot

Pull request overview

Copilot reviewed 4 out of 6 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

.github/workflows/xelp_npm_release.yml:8

The workflow header says publishing uses only the built-in GITHUB_TOKEN (no secret to provision), but later the install step prefers secrets.GH_TOKEN to read org packages. This is an internal inconsistency that can mislead someone setting this up in a new repo/org.

# Authentication is the workflow's own GITHUB_TOKEN, so there is no secret to
# provision or rotate. Consumers authenticate the way every other Plex client
# repo does, with a personal access token carrying read:packages.

ljunkie added 3 commits August 27, 2026 19:35

Copilot AI lite review requested due to automatic review settings August 28, 2026 02:37

Copilot started reviewing on behalf of ljunkie August 28, 2026 02:37 View session