feat: add npm package (#51)

Author: dsherret

.github/workflows/ci.generated.yml

@@ -74,14 +74,14 @@ jobs:
         run: |-
           git config --global core.autocrlf false
           git config --global core.eol lf
-      - uses: actions/checkout@v6
-      - uses: dsherret/rust-toolchain-file@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: dsherret/rust-toolchain-file@3551321aa44dd44a0393eb3b6bdfbc5d25ecf621 # v1
       - name: Cache cargo
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         if: '!startsWith(github.ref, ''refs/tags/'')'
         with:
           key: '${{ matrix.config.target }}'
-      - uses: denoland/setup-deno@v2
+      - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
       - name: Setup (Linux x86_64-musl)
         if: matrix.config.target == 'x86_64-unknown-linux-musl'
         run: |-
@@ -125,8 +125,8 @@ jobs:
       - name: Lint workflow generation
         if: '!startsWith(github.ref, ''refs/tags/'') && matrix.config.target == ''x86_64-unknown-linux-gnu'''
         run: |-
-          deno run -A .github/workflows/ci.ts --lint
-          deno run -A .github/workflows/release.ts --lint
+          ./.github/workflows/ci.ts --lint
+          ./.github/workflows/release.ts --lint
       - name: Test (Debug)
         if: 'matrix.config.run_tests == ''true'' && !startsWith(github.ref, ''refs/tags/'')'
         run: cargo test --locked --all-features
@@ -196,55 +196,55 @@ jobs:
           zip -r dprint-plugin-exec-loongarch64-unknown-linux-gnu.zip dprint-plugin-exec
           echo "::set-output name=ZIP_CHECKSUM::$(shasum -a 256 dprint-plugin-exec-loongarch64-unknown-linux-gnu.zip | awk '{print $1}')"
       - name: Upload artifacts (x86_64-apple-darwin)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: 'matrix.config.target == ''x86_64-apple-darwin'' && startsWith(github.ref, ''refs/tags/'')'
         with:
           name: x86_64-apple-darwin-artifacts
           path: target/x86_64-apple-darwin/release/dprint-plugin-exec-x86_64-apple-darwin.zip
       - name: Upload artifacts (aarch64-apple-darwin)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: 'matrix.config.target == ''aarch64-apple-darwin'' && startsWith(github.ref, ''refs/tags/'')'
         with:
           name: aarch64-apple-darwin-artifacts
           path: target/aarch64-apple-darwin/release/dprint-plugin-exec-aarch64-apple-darwin.zip
       - name: Upload artifacts (x86_64-pc-windows-msvc)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: 'matrix.config.target == ''x86_64-pc-windows-msvc'' && startsWith(github.ref, ''refs/tags/'')'
         with:
           name: x86_64-pc-windows-msvc-artifacts
           path: target/x86_64-pc-windows-msvc/release/dprint-plugin-exec-x86_64-pc-windows-msvc.zip
       - name: Upload artifacts (x86_64-unknown-linux-gnu)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: 'matrix.config.target == ''x86_64-unknown-linux-gnu'' && startsWith(github.ref, ''refs/tags/'')'
         with:
           name: x86_64-unknown-linux-gnu-artifacts
           path: target/x86_64-unknown-linux-gnu/release/dprint-plugin-exec-x86_64-unknown-linux-gnu.zip
       - name: Upload artifacts (x86_64-unknown-linux-musl)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: 'matrix.config.target == ''x86_64-unknown-linux-musl'' && startsWith(github.ref, ''refs/tags/'')'
         with:
           name: x86_64-unknown-linux-musl-artifacts
           path: target/x86_64-unknown-linux-musl/release/dprint-plugin-exec-x86_64-unknown-linux-musl.zip
       - name: Upload artifacts (aarch64-unknown-linux-gnu)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: 'matrix.config.target == ''aarch64-unknown-linux-gnu'' && startsWith(github.ref, ''refs/tags/'')'
         with:
           name: aarch64-unknown-linux-gnu-artifacts
           path: target/aarch64-unknown-linux-gnu/release/dprint-plugin-exec-aarch64-unknown-linux-gnu.zip
       - name: Upload artifacts (aarch64-unknown-linux-musl)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: 'matrix.config.target == ''aarch64-unknown-linux-musl'' && startsWith(github.ref, ''refs/tags/'')'
         with:
           name: aarch64-unknown-linux-musl-artifacts
           path: target/aarch64-unknown-linux-musl/release/dprint-plugin-exec-aarch64-unknown-linux-musl.zip
       - name: Upload artifacts (riscv64gc-unknown-linux-gnu)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: 'matrix.config.target == ''riscv64gc-unknown-linux-gnu'' && startsWith(github.ref, ''refs/tags/'')'
         with:
           name: riscv64gc-unknown-linux-gnu-artifacts
           path: target/riscv64gc-unknown-linux-gnu/release/dprint-plugin-exec-riscv64gc-unknown-linux-gnu.zip
       - name: Upload artifacts (loongarch64-unknown-linux-gnu)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: 'matrix.config.target == ''loongarch64-unknown-linux-gnu'' && startsWith(github.ref, ''refs/tags/'')'
         with:
           name: loongarch64-unknown-linux-gnu-artifacts
@@ -255,12 +255,19 @@ jobs:
       - build
     if: 'startsWith(github.ref, ''refs/tags/'')'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Download artifacts
-        uses: actions/download-artifact@v4
-      - uses: denoland/setup-deno@v2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24.x
+          registry-url: 'https://registry.npmjs.org'
       - name: Move downloaded artifacts to root directory
         run: |-
           mv x86_64-apple-darwin-artifacts/dprint-plugin-exec-x86_64-apple-darwin.zip .
@@ -293,10 +300,12 @@ jobs:
         run: 'echo "::set-output name=CHECKSUM::$(shasum -a 256 plugin.json | awk ''{print $1}'')"'
       - name: Update Config Schema Version
         run: 'sed -i ''s/exec\/0.0.0/exec\/${{ steps.get_tag_version.outputs.TAG_VERSION }}/'' deployment/schema.json'
+      - name: Build npm packages
+        run: deno run -A scripts/create_npm_packages.ts
       - name: Create release notes
         run: 'deno run -A ./scripts/generate_release_notes.ts ${{ steps.get_tag_version.outputs.TAG_VERSION }} ${{ steps.get_plugin_file_checksum.outputs.CHECKSUM }} > ${{ github.workspace }}-CHANGELOG.txt'
       - name: Release
-        uses: softprops/action-gh-release@v2.6.1
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
         env:
           GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
         with:
@@ -313,3 +322,5 @@ jobs:
             plugin.json
             deployment/schema.json
           body_path: '${{ github.workspace }}-CHANGELOG.txt'
+      - name: Publish npm packages
+        run: deno run -A scripts/publish_npm_packages.ts

.github/workflows/ci.ts

@@ -1,12 +1,5 @@
 #!/usr/bin/env -S deno run -A
-import {
-  conditions,
-  defineMatrix,
-  expr,
-  job,
-  step,
-  workflow,
-} from "jsr:@david/gagen@^0.5.0";
+import { conditions, defineMatrix, expr, job, step, workflow } from "jsr:@david/gagen@^0.5.0";
 
 enum OperatingSystem {
   Macx86 = "macos-15-intel",
@@ -174,7 +167,8 @@ const buildJob = job("build", {
     {
       name: "Setup cross",
       if: isCross,
-      run: "cargo install cross --git https://github.com/cross-rs/cross --rev 4090beca3cfffa44371a5bba524de3a578aa46c3",
+      run:
+        "cargo install cross --git https://github.com/cross-rs/cross --rev 4090beca3cfffa44371a5bba524de3a578aa46c3",
     },
     {
       name: "Build (Debug)",
@@ -211,8 +205,8 @@ const buildJob = job("build", {
       name: "Lint workflow generation",
       if: isNotTag.and(target.equals("x86_64-unknown-linux-gnu")),
       run: [
-        "deno run -A .github/workflows/ci.ts --lint",
-        "deno run -A .github/workflows/release.ts --lint",
+        "./.github/workflows/ci.ts --lint",
+        "./.github/workflows/release.ts --lint",
       ],
     },
     {
@@ -229,7 +223,7 @@ const buildJob = job("build", {
     ...profiles.map((profile) => ({
       name: `Upload artifacts (${profile.target})`,
       if: target.equals(profile.target).and(isTag),
-      uses: "actions/upload-artifact@v4",
+      uses: "actions/upload-artifact@v7",
       with: {
         name: profile.artifactsName,
         path: `target/${profile.target}/release/${profile.zipFileName}`,
@@ -257,15 +251,19 @@ const draftReleaseJob = job("draft_release", {
   if: isTag,
   needs: [buildJob],
   runsOn: "ubuntu-latest",
+  // id-token: write is required for npm --provenance
+  permissions: { contents: "write", "id-token": "write" },
   steps: [
-    { name: "Checkout", uses: "actions/checkout@v4" },
-    { name: "Download artifacts", uses: "actions/download-artifact@v4" },
+    { name: "Checkout", uses: "actions/checkout@v6" },
+    { name: "Download artifacts", uses: "actions/download-artifact@v8" },
     { uses: "denoland/setup-deno@v2" },
+    {
+      uses: "actions/setup-node@v6",
+      with: { "node-version": "24.x", "registry-url": "https://registry.npmjs.org" },
+    },
     {
       name: "Move downloaded artifacts to root directory",
-      run: profiles.map((profile) =>
-        `mv ${profile.artifactsName}/${profile.zipFileName} .`
-      ),
+      run: profiles.map((profile) => `mv ${profile.artifactsName}/${profile.zipFileName} .`),
     },
     {
       name: "Output checksums",
@@ -281,11 +279,19 @@ const draftReleaseJob = job("draft_release", {
     getPluginFileChecksum,
     {
       name: "Update Config Schema Version",
-      run: `sed -i 's/exec\\/0.0.0/exec\\/${getTagVersion.outputs.TAG_VERSION}/' deployment/schema.json`,
+      run:
+        `sed -i 's/exec\\/0.0.0/exec\\/${getTagVersion.outputs.TAG_VERSION}/' deployment/schema.json`,
+    },
+    {
+      // must run before "Create release notes" — the notes embed the main
+      // npm tarball's sha256 from npm-dist/publish-manifest.json.
+      name: "Build npm packages",
+      run: "deno run -A scripts/create_npm_packages.ts",
     },
     {
       name: "Create release notes",
-      run: `deno run -A ./scripts/generate_release_notes.ts ${getTagVersion.outputs.TAG_VERSION} ${getPluginFileChecksum.outputs.CHECKSUM} > \${{ github.workspace }}-CHANGELOG.txt`,
+      run:
+        `deno run -A ./scripts/generate_release_notes.ts ${getTagVersion.outputs.TAG_VERSION} ${getPluginFileChecksum.outputs.CHECKSUM} > \${{ github.workspace }}-CHANGELOG.txt`,
     },
     {
       name: "Release",
@@ -300,6 +306,10 @@ const draftReleaseJob = job("draft_release", {
         body_path: "${{ github.workspace }}-CHANGELOG.txt",
       },
     },
+    {
+      name: "Publish npm packages",
+      run: "deno run -A scripts/publish_npm_packages.ts",
+    },
   ],
 });
 
@@ -318,5 +328,5 @@ workflow({
 }).writeOrLint({
   filePath: new URL("./ci.generated.yml", import.meta.url),
   header: "# GENERATED BY ./ci.ts -- DO NOT DIRECTLY EDIT",
-  pinDeps: false,
+  pinDeps: true,
 });

.github/workflows/release.generated.yml

@@ -19,11 +19,11 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           token: '${{ secrets.GH_DPRINTBOT_PAT }}'
-      - uses: denoland/setup-deno@v2
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       - name: Bump version and tag
         env:
           GITHUB_TOKEN: '${{ secrets.GH_DPRINTBOT_PAT }}'

.github/workflows/release.ts

@@ -49,5 +49,5 @@ workflow({
 }).writeOrLint({
   filePath: new URL("./release.generated.yml", import.meta.url),
   header: "# GENERATED BY ./release.ts -- DO NOT DIRECTLY EDIT",
-  pinDeps: false,
+  pinDeps: true,
 });

scripts/create_npm_packages.ts

@@ -0,0 +1,84 @@
+import { $, CargoToml, getChecksum, processPlugin } from "jsr:@dprint/automation@0.11.2";
+
+const pluginName = "dprint-plugin-exec";
+const mainPackageName = "@dprint/exec";
+const outDir = "npm-dist";
+// where the platform zips are extracted before being repacked as npm sub-packages.
+const extractDir = "npm-binaries";
+
+const platforms: processPlugin.Platform[] = [
+  "darwin-aarch64",
+  "darwin-x86_64",
+  "linux-aarch64",
+  "linux-aarch64-musl",
+  "linux-x86_64",
+  "linux-x86_64-musl",
+  "linux-riscv64",
+  "linux-loongarch64",
+  "windows-x86_64",
+];
+
+const rootDir = $.path(import.meta.dirname!).join("..");
+const version = new CargoToml(rootDir.join("Cargo.toml")).version();
+
+const extractRoot = rootDir.join(extractDir);
+extractRoot.mkdirSync({ recursive: true });
+
+const platformInputs = await Promise.all(platforms.map(async (platform) => {
+  const zipPath = rootDir.join(
+    processPlugin.getStandardZipFileName(pluginName, platform),
+  );
+  const platformDir = extractRoot.join(platform);
+  platformDir.mkdirSync({ recursive: true });
+  await $`unzip -o ${zipPath.toString()} -d ${platformDir.toString()}`.quiet();
+  const binaryName = platform.startsWith("windows-") ? `${pluginName}.exe` : pluginName;
+  return {
+    platform,
+    binaryPath: platformDir.join(binaryName).toString(),
+  };
+}));
+
+const result = await processPlugin.createDprintOrgNpmPackages({
+  pluginName,
+  mainPackageName,
+  version,
+  outDir: rootDir.join(outDir).toString(),
+  platforms: platformInputs,
+  packageJsonExtra: {
+    description: "Execute a CLI as a dprint plugin to format code.",
+    license: "MIT",
+    repository: {
+      type: "git",
+      url: "git+https://github.com/dprint/dprint-plugin-exec.git",
+    },
+    homepage: "https://github.com/dprint/dprint-plugin-exec",
+  },
+});
+
+// hash the main tarball so the release-notes step can embed it in the
+// `npm:@dprint/exec@<version>/plugin.json@<hash>` reference users paste
+// into dprint.json. This is the hash dprint verifies before extracting.
+const mainPackageChecksum = await getChecksum(await Deno.readFile(result.mainPackageTarball));
+
+// emit a manifest so publish_npm_packages.ts knows the order and which
+// tarballs to publish without having to re-derive it from the directory.
+await Deno.writeTextFile(
+  rootDir.join(outDir, "publish-manifest.json").toString(),
+  JSON.stringify(
+    {
+      mainPackageName,
+      version,
+      subPackageTarballs: result.subPackageTarballs,
+      mainPackageTarball: result.mainPackageTarball,
+      mainPackageChecksum,
+    },
+    undefined,
+    2,
+  ) + "\n",
+);
+
+console.log("Main package tarball:", result.mainPackageTarball);
+console.log("Sub-package tarballs:");
+for (const tgz of result.subPackageTarballs) {
+  console.log("  " + tgz);
+}

scripts/create_plugin_file.ts

@@ -1,4 +1,4 @@
-import { $, CargoToml, processPlugin } from "jsr:@dprint/automation@0.10.3";
+import { $, CargoToml, processPlugin } from "jsr:@dprint/automation@0.11.0";
 
 const currentDirPath = $.path(import.meta.dirname!);
 const cargoFilePath = currentDirPath.join("../Cargo.toml");