From 780cf5d01220cbf088ab53dfa96c1a0c67db91ec Mon Sep 17 00:00:00 2001
From: Mikyo King <mikeldking@gmail.com>
Date: Fri, 28 Aug 2026 18:53:12 -0600
Subject: [PATCH] fix(ci): create git tags and GitHub releases for JS package
 publishes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`ci:publish` used `pnpm publish -r`, but changesets/action discovers what
was published from the newline-delimited JSON the publish script writes to
`$CHANGESETS_OUTPUT`, reading the `git-tag` events out of it. `pnpm publish`
never writes that file, so the released-package list was always empty, the
`create-github-releases` loop iterated zero times, and the action reported
`published: false`.

The npm publishes themselves have always succeeded — but no JS package has
ever been tagged or given a GitHub release. `git for-each-ref refs/tags`
contains zero `@arizeai/*` tags; every tag in the repo comes from
release-please.

Switch `ci:publish` to `changeset publish`, which emits those events and
tags each published package. Two changes come with it:

- `access` in the changesets config was `restricted`, unused because the
  old script passed `--access public` explicitly. `changeset publish` does
  honor it, so it has to become `public`.
- `changeset publish` builds its own publish flags and never passes
  `--provenance`, so request provenance through npm config instead. The
  workflow already grants `id-token: write`.

Note this does not backfill: the 6 packages' current versions stay
untagged, and tagging starts from the next release.
---
 .github/workflows/typescript-packages-publish.yml | 3 +++
 js/.changeset/config.json                         | 2 +-
 js/package.json                                   | 2 +-
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/typescript-packages-publish.yml b/.github/workflows/typescript-packages-publish.yml
index 8b77f154a85..06fc69d2212 100644
--- a/.github/workflows/typescript-packages-publish.yml
+++ b/.github/workflows/typescript-packages-publish.yml
@@ -60,6 +60,9 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # `changeset publish` builds its own publish flags and never passes
+          # --provenance, so request it through npm config instead.
+          NPM_CONFIG_PROVENANCE: true
       # - name: Release docs
       # Run pnpm run docs in js/packages/phoenix-client
       # Deploy the static files in js/packages/phoenix-client/docs to github pages
diff --git a/js/.changeset/config.json b/js/.changeset/config.json
index a6bd0116f94..1dbe1877c3a 100644
--- a/js/.changeset/config.json
+++ b/js/.changeset/config.json
@@ -4,7 +4,7 @@
   "commit": false,
   "fixed": [],
   "linked": [],
-  "access": "restricted",
+  "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
   "ignore": ["phoenix-experiment-runner", "demo-document-relevancy-experiment"],
diff --git a/js/package.json b/js/package.json
index 0a68f4dfbbd..6573804f528 100644
--- a/js/package.json
+++ b/js/package.json
@@ -21,7 +21,7 @@
   },
   "scripts": {
     "build": "pnpm run -r build",
-    "ci:publish": "pnpm --filter './packages/*' run -r build && pnpm publish -r --access public --provenance",
+    "ci:publish": "pnpm --filter './packages/*' run -r build && pnpm changeset publish",
     "ci:version": "pnpm changeset version",
     "clean": "pnpm run clean:node_modules",
     "clean:node_modules": "rimraf --glob '**/node_modules/**'",