askrjs/actions

Reusable GitHub Actions for npm package repositories.

What this repo provides

• actions/compute-release-tag — read package.json and compute a semver release tag
• actions/check-tag-exists — check whether a git tag exists on a remote
• actions/create-tag — create a git tag from a provided semver tag and push it to origin
• actions/create-release — create a GitHub release from an existing semver tag
• actions/validate-semver — validate a semver major.minor.patch value with optional v prefix support
• actions/validate-package-version — ensure a package.json version matches a release tag
• actions/validate-package-contract — enforce shared Askr package metadata and release commands
• actions/resolve-npm-tag — map a semver tag to an npm dist-tag
• actions/qualify-candidate-graph — reconstruct the reviewed 0.5.0 graph locally for ordinary prepublication CI
• .github/workflows/publish-package.yml — verify, then tag and publish through the caller repository's npm environment

Usage

These composite actions are intended to be consumed directly from this public repo. Workflows that use the git-based actions must check out the target repository, and workflows that read package metadata must provide a Node.js runtime. The git/metadata actions are standalone. The release-specific candidate helper selects its reviewed Node/npm toolchain and owns a temporary GET-only loopback registry; its exact boundaries are documented below.

The reusable publish workflow is called as a job after a repository's local CI workflow. Its write-capable publish job targets the caller repository's npm environment. Pass install-playwright: true for packages whose complete check includes browser tests. Version 0.0.0 is treated as an unreleased scaffold and is never published.

Compute a release tag

uses: askrjs/actions/actions/compute-release-tag@main

Outputs version and tag.

Check whether a tag exists

uses: askrjs/actions/actions/check-tag-exists@main
with:
  tag: v1.2.3

Outputs exists.

Create a tag

uses: askrjs/actions/actions/create-tag@main
with:
  tag: v1.2.3

Optional inputs include remote, git-user-name, git-user-email, and tag-message.

Create a release from a tag

uses: askrjs/actions/actions/create-release@main
with:
  tag: v1.2.3
  body: 'Release created from package version tag'
  github-token: ${{ secrets.GITHUB_TOKEN }}

Validate a semver value

uses: askrjs/actions/actions/validate-semver@main
with:
  semver: v1.2.3

Outputs value and normalized.

Validate a package version against a tag

uses: askrjs/actions/actions/validate-package-version@main
with:
  package-json-path: package.json
  tag: v1.2.3

Outputs version, tag, and normalized.

Validate an Askr package contract

uses: askrjs/actions/actions/validate-package-contract@main

The action validates the common public metadata, Node engine declaration, and release-facing scripts documented in PACKAGE_CONTRACT.md. It does not run the scripts; repository CI keeps those steps explicit.

Resolve an npm dist-tag

uses: askrjs/actions/actions/resolve-npm-tag@main
with:
  semver: v1.2.3-beta.1

Outputs npm_tag and version.

Action permissions

• actions/compute-release-tag has no special permissions requirements
• actions/check-tag-exists has no special permissions requirements
• actions/create-tag requires contents: write to push tags
• actions/create-release requires contents: write to create releases
• actions/validate-semver has no special permissions requirements
• actions/validate-package-version has no special permissions requirements
• actions/validate-package-contract has no special permissions requirements
• actions/resolve-npm-tag has no special permissions requirements

Notes

• These are composite actions and do not require repository JavaScript dependencies.
• actions/create-release uses the GitHub CLI and expects gh to be available on the runner.
• The repo intentionally stays minimal: action metadata, docs, and Dependabot config only.

Prepublication 0.5.0 candidate qualification

Candidate qualification documents the release-specific helper, its three phases, immutable helper/manifest pins and normal install/pack checks. It supports the 18 fixed producers and ordinary Examples, Website and Destroyer consumers. It cannot publish, create tags or change npm dist-tags, and needs only contents: read.

The committed template is intentionally incomplete and always rejects as a release manifest. Integrate the reviewed helper first; freeze the complete 18-package manifest separately after all reviewed builder commits are public. Actual hosted reconstruction and current-repository gates must pass before calling the graph qualified.