build(*): Verify baseline tags

.github/workflows/release.yml

@@ -33,6 +33,9 @@ jobs:
           node-version: 22
           cache: pnpm
 
+      - name: Verify release baseline tags
+        run: pnpm release:verify-baseline
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -55,4 +58,5 @@ jobs:
       - name: Publish packages
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true
         run: pnpm release

package.json

@@ -7,7 +7,8 @@
     "commitlint": "commitlint",
     "dev": "pnpm --filter tech-radar-editor dev",
     "release": "pnpm -r --workspace-concurrency=1 --filter './packages/*' exec semantic-release",
-    "release:dry-run": "pnpm -r --workspace-concurrency=1 --filter './packages/*' exec semantic-release --dry-run"
+    "release:dry-run": "pnpm -r --workspace-concurrency=1 --filter './packages/*' exec semantic-release --dry-run",
+    "release:verify-baseline": "node scripts/verify-release-baseline.mjs"
   },
   "engines": {
     "node": ">=18"

packages/tech-radar-editor-backend/package.json

@@ -16,6 +16,10 @@
   },
   "author": "Josh Creek",
   "license": "GPL-3.0",
+  "publishConfig": {
+    "provenance": true,
+    "registry": "https://registry.npmjs.org/"
+  },
   "release": {
     "extends": [
       "../../release.config.cjs",

packages/tech-radar-editor-backstage/package.json

@@ -13,6 +13,10 @@
   },
   "author": "Josh Creek",
   "license": "GPL-3.0",
+  "publishConfig": {
+    "provenance": true,
+    "registry": "https://registry.npmjs.org/"
+  },
   "release": {
     "extends": [
       "../../release.config.cjs",

packages/tech-radar-editor/package.json

@@ -20,6 +20,10 @@
   ],
   "author": "Josh Creek",
   "license": "GPL-3.0",
+  "publishConfig": {
+    "provenance": true,
+    "registry": "https://registry.npmjs.org/"
+  },
   "release": {
     "extends": [
       "../../release.config.cjs",

scripts/verify-release-baseline.mjs

@@ -0,0 +1,55 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+const packagesDir = join(process.cwd(), 'packages');
+
+const packageDirs = readdirSync(packagesDir, { withFileTypes: true })
+  .filter((entry) => entry.isDirectory())
+  .map((entry) => join(packagesDir, entry.name));
+
+const missingTags = [];
+
+for (const packageDir of packageDirs) {
+  const manifestPath = join(packageDir, 'package.json');
+  const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+
+  if (manifest.private) {
+    continue;
+  }
+
+  const expectedTag = `${manifest.name}-v${manifest.version}`;
+  const existingTag = execFileSync('git', ['tag', '--list', expectedTag], {
+    cwd: process.cwd(),
+    encoding: 'utf8',
+  }).trim();
+
+  if (!existingTag) {
+    missingTags.push({
+      name: manifest.name,
+      version: manifest.version,
+      tag: expectedTag,
+    });
+  }
+}
+
+if (missingTags.length > 0) {
+  console.error('Release baseline is incomplete.');
+  console.error('Create tags for the versions that were already published before semantic-release was enabled:');
+
+  for (const pkg of missingTags) {
+    console.error(`- ${pkg.name}: expected tag ${pkg.tag}`);
+  }
+
+  console.error('');
+  console.error('Example commands:');
+
+  for (const pkg of missingTags) {
+    console.error(`  git tag ${pkg.tag}`);
+  }
+
+  console.error('  git push origin --tags');
+  process.exit(1);
+}
+
+console.log('Release baseline tags are present for all publishable packages.');