[Kikobeats]

Publishing @kikobeats/got currently depends on a script that exists on one machine. This moves it into CI, in the same shape as is-antibot's release job, adapted to how this fork releases.

How it works

A release job runs after the tests on every push to v11:

• it reads version from package.json and checks npm;
• if that version is already published, the job stops there;
• otherwise it installs the pinned toolchain, runs npm publish --access=public, tags v$VERSION and creates the GitHub release with generated notes.

So merging a backport publishes nothing, and merging a version bump (like #5 for 11.8.8) releases it. Unlike is-antibot, nothing bumps the version automatically: v11 carries backports, not conventional-commit features, so the version stays a deliberate change in a PR.

The pinned install (dev dependencies as of 2021-06-15, pem@1.14.8, @types/node@14.18.34) is needed because npm publish runs prepare, which builds with the TypeScript version this branch pins.

Required secret

NPM_TOKEN, an npm automation token with publish access for the @kikobeats scope. This repository currently has no secrets; is-antibot uses NPM_TOKEN, GH_TOKEN, GIT_EMAIL, GIT_USERNAME. Tagging and the GitHub release use the built-in github.token (the job declares contents: write), so no other secret is needed.

Until the secret exists, a version bump will fail in the publish step. The tests are unaffected.

Testing

• The workflow parses, and the release job has needs: [test], if: github.event_name == 'push' and permissions: contents: write, so it never runs on pull requests.
• The publish decision was checked against npm: 11.8.8 reports "already published" and writes nothing, 11.8.9 writes publish=true.
• The install and build steps are the ones already proven by the version-bump release: a clean clone of v11 packs @kikobeats/got@11.8.8 with npm pack --dry-run and exit 0.

After this merges, ~/Downloads/publish-kikobeats-got.sh can be deleted.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VZiY7VMgg1nEMkCezwMXEC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: cad36bfe-c106-44ae-b830-1637312496f7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1c7c39e. Configure here.}

[cursor]

Missing token breaks release job

High Severity

setup-node with registry-url writes an .npmrc that interpolates NODE_AUTH_TOKEN, but the version check and install steps never set that variable. npm fails while expanding the config, so the already-published check always takes the publish path and install dies. Every push to v11 fails Release, and a new version cannot be published.

Additional Locations (1)

• .github/workflows/test.yml#L47-L51

 

^{Reviewed by Cursor Bugbot for commit 1c7c39e. Configure here.}

[Kikobeats]

Superseded by #9, which publishes from CI with automate-release release scripts adapted to v11 (standard-version bump, CHANGELOG, tag, GitHub release, ci-publish).