feat: publish and test via the shared ci-workflows reusable workflows

Author: kokorolx

.github/workflows/ci.yml

@@ -3,15 +3,22 @@ on:
   pull_request:
   push:
     branches: [main]
+permissions:
+  contents: read
 jobs:
-  version-sync:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: |
-          pkg=$(node -p "require('./package.json').version")
-          plg=$(node -p "require('./plugin.json').version")
-          if [ "$pkg" != "$plg" ]; then
-            echo "version mismatch: package.json=$pkg plugin.json=$plg"
-            exit 1
-          fi
+  test:
+    # ci-workflows python-ci @ main
+    uses: img2threejs/ci-workflows/.github/workflows/python-ci.yml@4b7a0612d2c52815792124a18ae3f9032a4f0a88
+    with:
+      python-version: '3.12'
+      test-command: |
+        pkg="$(node -p 'require("./package.json").version')"
+        plg="$(node -p 'require("./plugin.json").version')"
+        if [ "$pkg" != "$plg" ]; then
+          echo "version mismatch: package.json=$pkg plugin.json=$plg"
+          exit 1
+        fi
+        git clone --depth 1 https://github.com/img2threejs/img2 ../img2-harness
+        mkdir -p ../img2home
+        ln -s "$(cd ../img2-harness && pwd)" ../img2home/harness
+        IMG2_HOME="$(cd ../img2home && pwd)" python3 -m unittest discover -s tests

.github/workflows/publish.yml

@@ -4,20 +4,22 @@ on:
     tags: ['v*']
 permissions:
   contents: read
-  id-token: write
 jobs:
   publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-      - run: npm install -g npm@latest
-      - run: |
-          pkg=$(node -p "require('./package.json').version")
-          plg=$(node -p "require('./plugin.json').version")
-          [ "$pkg" = "$plg" ] || { echo "version mismatch: package.json=$pkg plugin.json=$plg"; exit 1; }
-          [ "v$pkg" = "$GITHUB_REF_NAME" ] || { echo "tag $GITHUB_REF_NAME != v$pkg"; exit 1; }
-      - run: npm publish --provenance --access public
+    # ci-workflows npm-publish (feat/reusable-npm-publish); re-pin to the merged main SHA once img2threejs/ci-workflows#2 lands
+    uses: img2threejs/ci-workflows/.github/workflows/npm-publish.yml@27da7a68505591492cb4ef7358968890c6e39844
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      tag: ${{ github.ref_name }}
+      version-file: plugin.json
+      node-version: '24'
+      python-version: '3.12'
+      test-command: |
+        git clone --depth 1 https://github.com/img2threejs/img2 ../img2-harness
+        mkdir -p ../img2home
+        ln -s "$(cd ../img2-harness && pwd)" ../img2home/harness
+        IMG2_HOME="$(cd ../img2home && pwd)" python3 -m unittest discover -s tests
+    secrets:
+      npm-token: ${{ secrets.NPM_TOKEN }}

README.md

@@ -61,11 +61,14 @@ to enumerate what matters, and the point of an oracle is to catch the change nob
 
 ## Publishing to npm
 
-1. Bump the version in **both** `plugin.json` and `package.json` — CI's `version-sync` job fails the build if they disagree.
+CI and publishing run through the org's shared [`img2threejs/ci-workflows`](https://github.com/img2threejs/ci-workflows) reusable workflows; this repo owns only its triggers and its test command.
+
+1. Bump the version in **both** `plugin.json` and `package.json` — the `ci` workflow's version-sync check fails the build if they disagree.
 2. Update `CHANGELOG.md`.
 3. Commit the bump.
-4. Tag the commit `vX.Y.Z` (matching the new version) and push the tag.
-5. The `publish` workflow picks up the tag, re-checks the version match, and runs `npm publish --provenance --access public` against `@img2threejs/plugin-character`.
+4. Tag the commit `vX.Y.Z` (matching the new version) and push the tag. A prerelease tag (`v1.2.3-beta.1`) publishes under the matching npm dist-tag (`beta`); a stable tag publishes under `latest`.
+5. The shared `npm-publish.yml` workflow re-validates the tag against `package.json` and `plugin.json`, runs this repo's tests in a job with no access to the publish credential, and runs `npm publish --provenance` using the org's `NPM_TOKEN` secret (a granular npm automation token with publish rights on the `@img2threejs` scope, configured once at the org or repo level — no per-repo trusted-publisher setup needed). Re-pushing a tag whose version is already on the registry is a no-op, not a failure.
+6. Workflow references in `.github/workflows/` are pinned to a specific `ci-workflows` commit SHA, per that repo's pinning policy.
 
 ## Licence