From 430a4dbe93f8a469adcf061bce965bb8fb7aa258 Mon Sep 17 00:00:00 2001 From: Ashish Mishra Date: Tue, 18 Aug 2026 11:55:03 +0530 Subject: [PATCH] release-prep: don't cut a release for a lockfile-only change package-lock.json sat in the minor bucket, but npm never publishes it and an installer resolves package.json's ranges itself. An in-range dependency bump changed only what CI builds from, and the train would still have cut a release whose tarball is byte-identical to the last one apart from the version string. The lockfile moves to the skip bucket; package.json stays in minor, since a range change is exactly what does reach consumers. --- .github/workflows/release-prep.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-prep.yml b/.github/workflows/release-prep.yml index f080d53..8cedd07 100644 --- a/.github/workflows/release-prep.yml +++ b/.github/workflows/release-prep.yml @@ -14,7 +14,10 @@ name: Release prep # warrant one: # # minor — behavior of the shipped artifact changes: -# src/**, package.json, package-lock.json +# src/**, package.json (package-lock.json is skip: npm never +# publishes it, and an installer resolves package.json's ranges +# itself, so an in-range dependency bump changes what CI builds +# from and nothing a consumer receives) # patch — only artifact/catalog text or metadata changes: # README.md, LICENSE, server.json # skip — nothing a release consumer receives changes (no PR at all): @@ -110,7 +113,7 @@ jobs: minor_files=""; patch_files=""; skip_files="" while IFS= read -r f; do case "$f" in - src/*|package.json|package-lock.json) + src/*|package.json) bump=minor minor_files="$minor_files$f, " ;; README.md|LICENSE|server.json)