ci: publish packages via git release branches, drop registry dependency

.github/workflows/release.yml

@@ -5,18 +5,87 @@ on:
     branches:
       - main
 
-# Requires two repo secrets:
-#   NPM_REGISTRY_URL - full URL of the Verdaccio registry, reachable FROM THE RUNNER.
-#                      Not set yet: the registry currently listens on 127.0.0.1:4873 on
-#                      the dev server and the firewall allows only 80/443/SSH, so no
-#                      external runner can reach it. Until that is resolved this job
-#                      will fail at the publish step by design, rather than silently
-#                      skipping the release. See docs/PACKAGE-EXTRACTION.md in the
-#                      marketplaces repo.
-#   NPM_TOKEN        - publish token for that registry (npm login --registry=<url>).
+# Publishes each package by force-pushing its built output to a release branch
+# (release/auth, release/payment) where the repo root IS the package. Consumers
+# install straight over git:
+#
+#   "@marketplaces/auth": "git+<this repo>.git#release/auth"
+#
+# No npm registry, no NPM_TOKEN, no network reachability problem - the only
+# credential needed is the checkout token this workflow already has.
 
 jobs:
-  release:
+  release-branches:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    strategy:
+      matrix:
+        package: [auth, payment]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build --workspace packages/${{ matrix.package }}
+
+      - name: Publish to release/${{ matrix.package }}
+        run: |
+          set -euo pipefail
+          PKG=${{ matrix.package }}
+          BRANCH="release/$PKG"
+          VERSION=$(node -p "require('./packages/$PKG/package.json').version")
+
+          STAGE=$(mktemp -d)
+          cp -r "packages/$PKG/dist" "$STAGE/dist"
+          node -e "
+            const p = require('./packages/$PKG/package.json');
+            delete p.scripts;
+            delete p.devDependencies;
+            require('fs').writeFileSync('$STAGE/package.json', JSON.stringify(p, null, 2) + '\n');
+          "
+          cat > "$STAGE/README.md" <<EOF
+          # @marketplaces/$PKG — release branch
+
+          **Generated branch. Do not edit by hand.** Built from \`main\` at $GITHUB_SHA.
+
+          Install:
+
+          \`\`\`
+          git+${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git#$BRANCH
+          \`\`\`
+
+          Source lives on \`main\` under \`packages/$PKG\`.
+          EOF
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          git checkout --orphan "$BRANCH"
+          git rm -rf --cached . > /dev/null
+          find . -maxdepth 1 -not -name '.git' -not -name '.' -exec rm -rf {} +
+          cp -r "$STAGE/." .
+
+          git add -A
+          if git diff --cached --quiet; then
+            echo "No change for $PKG, nothing to publish."
+            exit 0
+          fi
+          git commit -q -m "release: @marketplaces/$PKG $VERSION (built from $GITHUB_SHA)"
+          git push -f origin "$BRANCH"
+
+  version-pr:
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -36,31 +105,11 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Build
-        run: npm run build
-
-      - name: Test
-        run: npm test
-
-      - name: Configure registry auth
-        run: |
-          if [ -z "${{ secrets.NPM_REGISTRY_URL }}" ] || [ -z "${{ secrets.NPM_TOKEN }}" ]; then
-            echo "NPM_REGISTRY_URL and/or NPM_TOKEN are not set on this repo."
-            echo "The registry is not reachable from CI yet - see the comment at the top of this file."
-            exit 1
-          fi
-          REGISTRY="${{ secrets.NPM_REGISTRY_URL }}"
-          HOST_PATH="${REGISTRY#http://}"
-          HOST_PATH="${HOST_PATH#https://}"
-          {
-            echo "@marketplaces:registry=${REGISTRY}"
-            echo "//${HOST_PATH%/}/:_authToken=${{ secrets.NPM_TOKEN }}"
-          } >> .npmrc
-
-      - name: Create release PR or publish
+      # Opens/updates a "Version Packages" PR when unreleased changesets exist.
+      # Merging that PR bumps versions on main, which re-runs release-branches above.
+      - name: Version PR
         uses: changesets/action@v1
         with:
           version: npm run version
-          publish: npm run release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}