feat(release): Split gpr and npm release into separate jobs

.github/workflows/release.yml

@@ -12,15 +12,15 @@ on:
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
-  build:
-    name: Release packages
+  version:
+    name: Create release Pull Request
     if: ${{ !contains(github.event.head_commit.message, '[ci skip]') }}
     runs-on: ubuntu-latest
     permissions:
-      id-token: "write"
       contents: "write"
-      packages: "write"
       pull-requests: "write"
+    outputs:
+      has-changesets: ${{ steps.changesets.outputs.has-changesets }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -39,34 +39,61 @@ jobs:
         env:
           NPM_AUTH_TOKEN: ${{ secrets.READER_TOKEN }}
 
-      - name: Create release Pull Request or publish to NPM
+      # Without `publish-script` the action only creates/updates the release PR
+      - name: Create or update release Pull Request
         id: changesets
         uses: changesets/action@v2
         with:
           version-script: yarn create-version
+        env:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+  # Both publish jobs are idempotent: `changeset publish` only publishes versions missing from the target registry.
+  # Re-run a failed job to retry that registry without affecting the other.
+  publish-npm:
+    name: Publish to npm
+    needs: version
+    if: ${{ needs.version.outputs.has-changesets == 'false' }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: "write"
+      contents: "write"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: lts/*
+          cache: yarn
+          cache-dependency-path: "yarn.lock"
+
+      - name: Install dependencies
+        run: yarn
+        env:
+          NPM_AUTH_TOKEN: ${{ secrets.READER_TOKEN }}
+
+      # changeset v3 uses `yarn npm info`, which reads the @navikt scope registry (GPR) from .yarnrc.yml.
+      # Only changes this job's checkout, after install.
+      - name: Point @navikt scope to npm
+        run: yarn config set npmScopes.navikt.npmRegistryServer "https://registry.npmjs.org"
+
+      - name: Publish to npm
+        id: changesets
+        uses: changesets/action@v2
+        with:
           publish-script: yarn release
           create-github-releases: false
         env:
-          # Use OIDC for npm authentication instead of NPM_TOKEN
-          # https://github.com/changesets/changesets/issues/1152#issuecomment-3190884868
+          # No token: `yarn npm publish` falls back to npm OIDC (trusted publishing)
           NPM_TOKEN: ""
-          # Needed for push to main
+          # `yarn npm publish` ignores the scope's npmRegistryServer and defaults to registry.yarnpkg.com
+          YARN_NPM_PUBLISH_REGISTRY: https://registry.npmjs.org
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Publish to GPR
-        if: steps.changesets.outputs.published == 'true'
-        id: changesets-gpr
-        uses: changesets/action@v2
-        with:
-          publish-script: yarn changeset publish
-          create-github-releases: false
-        env:
-          NPM_TOKEN: ""
-          # changeset v3 publishes with `yarn npm publish`, which reads the @navikt scope (GPR) from .yarnrc.yml
-          NPM_AUTH_TOKEN: ${{ secrets.GIT_REPO }}
-          # Needed for push to main
-          github-token: ${{ secrets.GIT_REPO }}
-
       - name: Generate icon.zip
         if: steps.changesets.outputs.published == 'true'
         run: yarn zip:icons
@@ -82,10 +109,11 @@ jobs:
           identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
 
       - name: Get @navikt/ds-css version
+        if: steps.changesets.outputs.published == 'true'
         run: |
           VERSION=$(yarn css:get-version)
           echo "version=$VERSION" >> $GITHUB_ENV
-          echo "Version of @navikt/ds-css: ${{ env.version }}"
+          echo "Version of @navikt/ds-css: $VERSION"
 
       - name: Upload CSS to Nav CDN
         if: steps.changesets.outputs.published == 'true'
@@ -96,3 +124,40 @@ jobs:
           destination: "@navikt/ds-css"
           project_id: ${{ vars.NAIS_MANAGEMENT_PROJECT_ID }}
           identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
+
+  publish-gpr:
+    name: Publish to GitHub Packages
+    needs: version
+    if: ${{ needs.version.outputs.has-changesets == 'false' }}
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed for `publishConfig.provenance`
+      id-token: "write"
+      contents: "read"
+      packages: "write"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: lts/*
+          cache: yarn
+          cache-dependency-path: "yarn.lock"
+
+      - name: Install dependencies
+        run: yarn
+        env:
+          NPM_AUTH_TOKEN: ${{ secrets.READER_TOKEN }}
+
+      - name: Build packages
+        run: yarn build:release
+
+      # Git tags and GitHub releases are handled by the npm job
+      - name: Publish to GitHub Packages
+        run: yarn changeset publish --no-git-tag
+        env:
+          NPM_AUTH_TOKEN: ${{ secrets.GIT_REPO }}
+          # `yarn npm publish` ignores the scope's npmRegistryServer and defaults to registry.yarnpkg.com
+          YARN_NPM_PUBLISH_REGISTRY: https://npm.pkg.github.com

package.json

@@ -24,7 +24,8 @@
     "changelog": "yarn update:repo-changelog",
     "changeset": "changeset",
     "create-version": "changeset version && yarn changelog && yarn",
-    "release": "yarn boot && yarn docgen:meta && node tooling/scripts/publish-npm.mts && yarn script:git-release",
+    "build:release": "yarn boot && yarn docgen:meta",
+    "release": "yarn build:release && changeset publish && yarn script:git-release",
     "postinstall": "husky"
   },
   "workspaces": [

tooling/scripts/publish-npm.mts

@@ -1,37 +0,0 @@
-/**
- * `changeset publish` (v3) uses `yarn npm info/publish` in Yarn Berry repos, which reads
- * the `@navikt` scope registry from `.yarnrc.yml`. That scope points to GitHub Packages
- * for installs, so we temporarily point it to npmjs while publishing (auth via OIDC).
- */
-import { spawnSync } from "node:child_process";
-import { readFileSync, writeFileSync } from "node:fs";
-
-const YARNRC_PATH = ".yarnrc.yml";
-const GPR_REGISTRY = `npmRegistryServer: "https://npm.pkg.github.com"`;
-const NPM_REGISTRY = `npmRegistryServer: "https://registry.npmjs.org"`;
-
-const originalYarnrc = readFileSync(YARNRC_PATH, "utf-8");
-
-if (!originalYarnrc.includes(GPR_REGISTRY)) {
-  console.error(`Expected ${YARNRC_PATH} to contain '${GPR_REGISTRY}'`);
-  process.exit(1);
-}
-
-let exitCode = 1;
-
-try {
-  writeFileSync(
-    YARNRC_PATH,
-    originalYarnrc.replace(GPR_REGISTRY, NPM_REGISTRY),
-  );
-
-  const result = spawnSync("yarn", ["changeset", "publish"], {
-    stdio: "inherit",
-  });
-
-  exitCode = result.status ?? 1;
-} finally {
-  writeFileSync(YARNRC_PATH, originalYarnrc);
-}
-
-process.exit(exitCode);