chore: run publint before publishing packages

[huytdps13400]

Summary

• derive each package's actual publish path from publishConfig.directory
• run pinned Publint 0.3.24 before npm and pkg.pr.new publishing
• lint transformed dist artifacts directly while letting root-published packages use their normal pack file list
• execute package lifecycle scripts explicitly, then publish with --ignore-scripts so the gate sits before the irreversible publish step

Fixes #2866

Verification

• oxfmt --check scripts/_utils.ts scripts/publish.ts scripts/publish-pkg-pr.ts
• oxlint -c oxlint.config.ts --max-warnings=0 scripts/_utils.ts scripts/publish.ts scripts/publish-pkg-pr.ts
• isolated strict TypeScript check for all three scripts
• SKIP_TESTS=true pnpm --filter @typegpu/color run prepublishOnly --skip-publish-tag-check
• Publint pass for @typegpu/color/dist (--pack=false)
• Publint pass for create-typegpu (normal pnpm pack)
• pnpm publish --ignore-scripts --dry-run for both publish-directory and package-root flows
• git diff --check

[Copilot]

Pull request overview

Adds a pinned Publint validation gate before npm and pkg.pr.new publishing, including support for packages published from configured directories.

Changes:

• Derives effective package publish paths.
• Runs lifecycle preparation and Publint validation.
• Publishes with scripts disabled after validation.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Summary	Findings
scripts/publish.ts	Prepares, validates, and publishes npm packages.	Critical: the lifecycle invocation does not pass the package publish tag, causing prerelease publishing to fail before validation or publishing.
scripts/publish-pkg-pr.ts	Validates packages before pkg.pr.new publication.	No final comments.
scripts/_utils.ts	Adds publish-path metadata and Publint arguments.	No final comments.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[pullfrog]

ℹ️ No blocking issues — the publint gate is real and correctly wired (publint's CLI exits non-zero on error-level findings) and the sequencing is sound: explicit prepublishOnly transforms the artifact, publint validates it, then publish --ignore-scripts publishes without re-running. A couple of rough edges worth a look are inline and below.

Reviewed changes

• scripts/_utils.ts — adds pinned PUBLINT_PACKAGE, reads each package's publishConfig.directory into PackageInfo.publishPath, and exports getPublintArgs() which passes --pack=false for packages that publish from a subdirectory and the plain path for root-published ones.
• scripts/publish-pkg-pr.ts — after the existing shared prepublishOnly --skip-publish-tag-check build, runs publint once per package about to be published.
• scripts/publish.ts — in the per-package loop, explicitly runs prepublishOnly, then publint, then pnpm publish --provenance --no-git-checks --ignore-scripts [--tag] [--dry-run].

ℹ️ The gate only hard-fails on error-level findings

publint v0.3.24's formatMessages sets process.exitCode = 1 only when errors.length > 0; warnings and suggestions print but do not fail the run (default --level suggestion). That satisfies the "run publint before publishing" goal, but it is weaker than the repo's own lint hygiene — oxlint is enforced with --max-warnings=0 elsewhere in this workspace. A package that ships with a warning (e.g. one missing type, a suggestion-level finding here) will still pass the gate. Confirm that error-only is the intended threshold, or the gate may not catch what you'd consider "dirty" packages.

Technical details

# Consider whether the publint gate should fail on warnings/suggestions

## Affected sites
- scripts/publish.ts (per-package publint in the publish loop)
- scripts/publish-pkg-pr.ts (per-package publint after the shared build)

## Required outcome
- Decide and enforce the gate's intended strictness for the publish path.

## Suggested approach (optional)
- Pass `--strict` so warnings escalate to errors. Note publint suggestions still won't fail a run even under `--strict`, so if a fully clean package is required, add an assertion on the message output.

ℹ️ Nitpicks

• Root-published packages (eslint-plugin-typegpu, tgpu-gen, typegpu-cli, create-typegpu) flow through publint's auto pack; only @typegpu/color/dist (--pack=false) and create-typegpu were exercised in the PR's verification list. The gate could newly fail on a previously-published package at release time — worth a one-time publint dry-run across the remaining public packages before merge.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[huytdps13400]

Followed up on the non-blocking review items:

• Kept Publint's default error threshold intentionally. A full run shows existing warnings in create-typegpu, eslint-plugin-typegpu, @typegpu/cli, @typegpu/color, @typegpu/noise, and @typegpu/three, plus suggestions in tgpu-gen and unplugin-typegpu. Adding --strict here would turn this publishing-gate PR into unrelated package metadata/type cleanup; errors still fail the command.
• Ran the actual prepublish flow plus Publint 0.3.24 across all 15 public packages. Every package exited successfully; both root-pack and transformed-dist modes were covered.

The prerelease tag issue from the earlier review is fixed in 0fb487f and its inline thread is resolved.

[pullfrog]

✅ No new issues found.

Reviewed changes

Since the prior Pullfrog review (ac48461), two commits landed:

• scripts/publish.ts — preserve prerelease tag through the lifecycle. The per-package env now sets npm_config_tag: tag (for all but the latest tag) and is threaded through both the explicit pnpm run prepublishOnly and the final pnpm publish, instead of the prior bare { ...process.env, SKIP_TESTS: 'true' }. This resolves the blocked prerelease publish path: prepublishOnly's tgpu-dev-cli prepack calls verifyPublishTag() (via prepack.mjs:132), which reads process.env.npm_config_tag in verify-publish-tag.mjs:15 and throws when it doesn't match the version's prerelease tag. Before this fix, a prerelease package (e.g. 0.1.0-alpha.1) would fail validation under the mismatched/undefined tag; now the explicit lifecycle step and the real publish share the same tag. latest correctly sets no tag and passes no --tag.
• scripts/publish — documented the lifecycle invariant. The new comment records that prepublishOnly is the only publish-time transform used by public packages, justifying --ignore-scripts on the publish step.

Verification: verifyPublishTag() reads npm.tags_tag/npm_config_tag and throws only when the version contains a prerelease marker that doesn't match. Setting the same tag in both the validation step and the publish call is consistent and resolves the sequencing concern raised earlier.

  ^{｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}