build: use yarn publish

.github/workflows/release.yml

@@ -65,6 +65,7 @@ jobs:
       ## ! no npm build at the moment
       - name: bump VERSION
         id: bump
+        # `npm version` seams superior to `yarn version` ...
         run: |
           set -eux
           COMMIT_SIG="Signed-off-by: $(git config user.name) <$(git config user.email)>"
@@ -183,7 +184,7 @@ jobs:
       - name: run tests
         run: yarn run test:node
 
-  publish-NPMJS:
+  publish-registry:
     needs:
       - "build"
       - "test-licenses"
@@ -205,20 +206,31 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_ACTIVE_LTS }}
-      - name: login to NPMJS
-        run: npm config set "//registry.npmjs.org/:_authToken=$NPMJS_AUTH_TOKEN"
+      - name: Setup yarn ${{ env.YARN_VERSION }}
+        run: |
+          set -eux
+          corepack enable yarn
+          yarn set version "$YARN_VERSION"
+      - name: make lock
+        # for stupid reasons `yarn publish` requires a lockfile
+        run: |
+          yarn workspaces focus --production
+          yarn install --mode update-lockfile
+      - name: login to YARNPKG
+        run: yarn config set npmAuthToken "$NPM_AUTH_TOKEN"
         env:
-          NPMJS_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-      - name: publish to NPMJS as "${{ env.NPMJS_RELEASE_TAG }}"
+          NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: publish to registry as "${{ env.NPMJS_RELEASE_TAG }}"
         run: >
-          npm publish
-          --provenance
+          yarn npm publish
           --access public
           --tag "$NPMJS_RELEASE_TAG"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
       - name: pack release result
         run: |
           mkdir -p "$PACKED_DIR"
-          npm pack --pack-destination "$PACKED_DIR"
+          yarn pack --out "$PACKED_DIR"/%s-%v.tgz
       - name: artifact release result
         # see https://github.com/actions/upload-artifact
         uses: actions/upload-artifact@v4
@@ -227,12 +239,11 @@ jobs:
           path: ${{ env.PACKED_DIR }}/
           if-no-files-found: error
 
-
   release-GH:
     needs:
       - "bump"
       - "build"
-      - "publish-NPMJS"
+      - "publish-registry"
     name: publish GitHub
     runs-on: ubuntu-latest
     timeout-minutes: 30

package.json

@@ -1,7 +1,7 @@
 {
   "private": true,
   "name": "@cyclonedx/yarn-plugin-cyclonedx",
-  "version": "1.0.0-rc.3",
+  "version": "1.0.0-rc.5",
   "description": "Create CycloneDX Software Bill of Materials (SBOM) from yarn projects.",
   "license": "Apache-2.0",
   "keywords": [
@@ -111,6 +111,7 @@
   ],
   "publishConfig": {
     "$comment": "this section defines how `tools/make-dist-package.cjs` works",
+    "private": false,
     "main": "./yarn-plugin-cyclonedx.cjs",
     "files": [
       "/README.md",

tools/write-dist-manifest.cjs

@@ -40,22 +40,20 @@ function main (outputFile) {
   const manifestSource = JSON.parse(readFileSync(manifestSourceFile))
   const manifest = structuredClonePolyfill(manifestSource)
   for (const [k, v] of Object.entries(manifestSource.publishConfig ?? {})) {
+    if (k[0] === '$') {
+      continue
+    }
+    if (k === 'registry') {
+      continue
+    }
     manifest[k] = v
   }
   // dist is expected to be a bundle - no deps need install
   manifest.dependencies = {}
   // move deps to devDeps - for documentation purposes
   manifest.devDependencies = {
-    ...manifestSource.dependencies,
-    ...manifestSource.devDependencies
-  }
-
-  delete manifest.publishConfig
-  delete manifest.private
-  for (const k of Object.keys(manifest)) {
-    if (k.startsWith('$')) {
-      delete manifest[k]
-    }
+    ...manifestSource.dependencies
+  //  ...manifestSource.devDependencies
   }
 
   writeFileSync(outputFile, JSON.stringify(manifest, undefined, 2))