Add tag-triggered publish CI (npm, anywidget, VS Code Open VSX)

.github/actions/setup/action.yml

@@ -0,0 +1,22 @@
+name: Setup
+description: Node 24 + pnpm, root install, and optional extension installs
+
+inputs:
+  extensions:
+    description: Space-separated extension dirs under extensions/ to also install
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-node@v6
+      with:
+        node-version: 24
+        registry-url: https://registry.npmjs.org
+    - shell: bash
+      env:
+        EXTENSIONS: ${{ inputs.extensions }}
+      run: |
+        corepack enable
+        pnpm install
+        for ext in $EXTENSIONS; do pnpm -C "extensions/$ext" install; done

.github/workflows/lint.yml

@@ -10,36 +10,19 @@ jobs:
   prek:
     runs-on: ubuntu-latest
     steps:
-      - name: Check out repo
-        uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v6
+      # install extension deps too: vscode is type-aware linted by root oxlint (needs
+      # e.g. @types/vscode), anywidget is checked by root svelte-check (needs its
+      # matterviz/* subpath imports to resolve, else TS2882)
+      - uses: ./.github/actions/setup
         with:
-          node-version: 24
-
-      - run: corepack enable && pnpm install
-
-      # vscode extension is type-aware linted by root oxlint; install its deps
-      # (e.g. @types/vscode) so module resolution succeeds in CI.
-      - run: pnpm -C extensions/vscode install
-
-      # anywidget extension is checked by root svelte-check; install its deps so
-      # its matterviz/* subpath imports resolve in CI (otherwise TS2882).
-      - run: pnpm -C extensions/anywidget install
-
+          extensions: vscode anywidget
       - uses: j178/prek-action@v2
 
   knip:
     runs-on: ubuntu-latest
     steps:
-      - name: Check out repo
-        uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-
-      - run: corepack enable && pnpm install
-
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup
       - name: Check for unused dependencies
         run: pnpm run knip

.github/workflows/publish.yml

@@ -0,0 +1,186 @@
+name: Publish
+
+# On a new vX.Y.Z tag: gate on lint + unit tests, then publish in parallel the
+# `matterviz` npm package, the VS Code extension (Marketplace + Open VSX) and the
+# `matterviz-anywidget` npm bundle. workflow_dispatch (re)publishes a given version.
+#
+# Required repo secrets:
+#   NPM_TOKEN  - npm automation token (matterviz + matterviz-anywidget)
+#   VSCE_PAT   - Azure DevOps PAT for the VS Code Marketplace (publisher `janosh`)
+#   OVSX_PAT   - Open VSX token (namespace once: `npx ovsx create-namespace janosh -p <OVSX_PAT>`)
+
+on:
+  push:
+    tags: ['v*.*.*']
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version to publish (e.g. 0.4.0)
+        required: true
+        type: string
+      dry_run:
+        description: Dry run -- build, package & validate everything, but do not publish
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+# one publish per ref, but never cancel an in-flight one (a half-published release is worse)
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.resolve.outputs.version }}
+    steps:
+      - id: resolve
+        # input via env (not ${{ }}) to avoid shell injection; validate before use
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.version }}
+        shell: bash
+        run: |
+          if [ "${{ github.event_name }}" = workflow_dispatch ]; then
+            version="$INPUT_VERSION"
+          else
+            version="${GITHUB_REF#refs/tags/}"
+          fi
+          version="${version#v}" # strip optional leading v from tags / manual input alike
+          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]] || {
+            echo "Invalid version: $version"; exit 1; }
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+  # === Gate: publish only if lint + unit tests pass for this exact ref ===
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      # ext deps so type-aware lint / svelte-check resolve their imports in CI
+      - uses: ./.github/actions/setup
+        with:
+          extensions: vscode anywidget
+      - uses: j178/prek-action@v2
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup
+      - name: Unit tests
+        run: pnpm exec vp test --run
+
+  # === Publish: matterviz component library to npm ===
+  npm:
+    needs: [version, lint, test]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # npm provenance
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+      - name: Verify version matches the tag
+        env:
+          EXPECTED: ${{ needs.version.outputs.version }}
+        run: |
+          actual=$(node -p "require('./package.json').version")
+          [ "$actual" = "$EXPECTED" ] || { echo "package.json ($actual) != release ($EXPECTED) -- bump it in the release commit"; exit 1; }
+      - name: Build component library
+        run: pnpm package:dist
+      # npm (not pnpm): only `npm publish --provenance` emits provenance. --dry-run packs
+      # & validates without uploading (and skips provenance, which needs the registry)
+      - name: Publish to npm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          if [ "$DRY_RUN" = true ]; then
+            npm publish --ignore-scripts --access public --dry-run
+          else
+            npm publish --ignore-scripts --provenance --access public
+          fi
+
+  # === Publish: VS Code extension to Marketplace + Open VSX ===
+  vscode:
+    needs: [version, lint, test]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      # root install too: the webview build bundles ../../src/lib (three/d3/etc.)
+      - uses: ./.github/actions/setup
+        with:
+          extensions: vscode
+      - name: Verify version matches the tag
+        env:
+          EXPECTED: ${{ needs.version.outputs.version }}
+        run: |
+          actual=$(node -p "require('./extensions/vscode/package.json').version")
+          [ "$actual" = "$EXPECTED" ] || { echo "extensions/vscode ($actual) != release ($EXPECTED) -- bump it in the release commit"; exit 1; }
+      - name: Build extension
+        run: pnpm -C extensions/vscode run build
+      - name: Package VSIX
+        working-directory: extensions/vscode
+        run: npx @vscode/vsce package --no-dependencies -o matterviz.vsix
+      # vsce/ovsx have no dry-run; packaging above already exercises the build, so a
+      # dry run just skips the two uploads (and needs no PATs)
+      - name: Publish to VS Code Marketplace
+        if: ${{ !inputs.dry_run }}
+        working-directory: extensions/vscode
+        run: npx @vscode/vsce publish --no-dependencies --packagePath matterviz.vsix
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+      - name: Publish to Open VSX
+        if: ${{ !inputs.dry_run }}
+        working-directory: extensions/vscode
+        run: npx ovsx publish matterviz.vsix --pat "$OVSX_PAT"
+        env:
+          OVSX_PAT: ${{ secrets.OVSX_PAT }}
+
+  # === Publish: prebuilt matterviz-anywidget bundle to npm ===
+  anywidget:
+    needs: [version, lint, test]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # npm provenance
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          extensions: anywidget
+      - name: 'Build component library (resolves the file: dependency)'
+        run: pnpm package:dist
+      - name: Build + size-gate bundle
+        working-directory: extensions/anywidget
+        env:
+          PUBLISH_VERSION: ${{ needs.version.outputs.version }}
+        run: |
+          # version isn't bumped by the release commit, so set it here
+          npm version "$PUBLISH_VERSION" --no-git-tag-version --allow-same-version
+          pnpm run build
+          # sanity-gate before publishing (runtime coverage lives in pymatviz's tests)
+          test -s build/matterviz.js && test -s build/matterviz.css
+          js_bytes=$(wc -c < build/matterviz.js)
+          # >1MB: all components present; <5MB: h5wasm/moyo WASM didn't creep back in
+          test "$js_bytes" -gt 1000000 || { echo "bundle too small ($js_bytes B)"; exit 1; }
+          test "$js_bytes" -lt 5000000 || { echo "bundle too large ($js_bytes B) -- WASM re-bundled?"; exit 1; }
+      - name: Publish to npm
+        working-directory: extensions/anywidget
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          if [ "$DRY_RUN" = true ]; then
+            npm publish --ignore-scripts --access public --dry-run
+          else
+            npm publish --ignore-scripts --provenance --access public
+          fi

.github/workflows/test.yml

@@ -16,10 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-      - run: corepack enable && pnpm install
+      - uses: ./.github/actions/setup
       - name: Unit tests
         run: pnpm exec vp test --run
 
@@ -31,10 +28,7 @@ jobs:
         shard: [1, 2, 3, 4]
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-      - run: corepack enable && pnpm install
+      - uses: ./.github/actions/setup
       - name: Install Playwright
         run: npx playwright install chromium
       - name: E2E tests (shard ${{ matrix.shard }}/4)