Dual packaging, without breaking existing consumers (#628)

Co-authored-by: Yasumasa Ashida <ys.ashida@gmail.com>

.github/workflows/merge-to-master.yml

@@ -8,30 +8,29 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
-    strategy:
-      matrix:
-        node-version: [12.16.3]
-
     steps:
-      - name: Get branch name (merge)
-        if: github.event_name != 'pull_request'
+      - name: Get branch name
         shell: bash
         run: echo "BRANCH_NAME=$(echo ${GITHUB_REF#refs/heads/} | tr / -)" >> $GITHUB_ENV
 
-      - name: Get branch name (pull request)
-        if: github.event_name == 'pull_request'
-        shell: bash
-        run: echo "BRANCH_NAME=$(echo ${GITHUB_HEAD_REF} | tr / -)" >> $GITHUB_ENV
-
       - uses: actions/checkout@v4
-      - name: Use Node.js ${{ matrix.node-version }}
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+
+      # tsdown requires Node ^22.18.0 || >=24.11.0. The published artifacts are
+      # still ES5 — see the `pack-smoke` job in pull-request.yml.
+      - name: Set up node
         uses: actions/setup-node@v4
         with:
-          node-version: ${{ matrix.node-version }}
-      - run: npm i -g nyc@15
-      - run: npm ci
-      - run: npm run build
-      - run: nyc npm test && nyc report --reporter=text-lcov | ./node_modules/coveralls/bin/coveralls.js
+          node-version: "24"
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build
+
+      # `pnpm test` already runs ava under nyc; this only reports the result.
+      - run: pnpm test && pnpm exec nyc report --reporter=text-lcov | pnpm exec coveralls
         env:
           COVERALLS_SERVICE_NAME: GithubActions
           COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}

.github/workflows/publish.yml

@@ -21,13 +21,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+
+      # tsdown requires Node ^22.18.0 || >=24.11.0. This only affects how the
+      # package is built; the artifacts it emits are still ES5.
       - uses: actions/setup-node@v4
         with:
-          node-version: 12.16.3
-      - uses: actions/cache@v4
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package.json') }}
+          node-version: "24"
+          cache: pnpm
+
       # Store the release version (from release tag or manual input)
       - name: Set release version
         run: |
@@ -38,14 +42,33 @@ jobs:
             echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
             echo "Release triggered from tag: ${GITHUB_REF#refs/*/}"
           fi
-      - run: npm ci
-      - run: npm version $RELEASE_VERSION --no-git-tag-version
-      - run: npm run build
+
+      - run: pnpm install --frozen-lockfile
+      - run: npm version $RELEASE_VERSION --no-git-tag-version --allow-same-version
+      - run: pnpm build
+
+      # Guard the release: the same checks the PR workflow runs, against the
+      # artifacts actually about to be published.
+      - run: pnpm test
+      - run: pnpm exec publint
+      - run: pnpm exec attw --pack . --profile node16 --entrypoints .
+
+      # Upload only what `files` publishes, plus the manifest. The previous
+      # `path: .` also shipped node_modules through the artifact store.
       - name: Upload build artifacts
         uses: actions/upload-artifact@v4
         with:
           name: dist
-          path: .
+          path: |
+            package.json
+            README.md
+            LICENSE
+            es5.js
+            bundled.js
+            bowser.mjs
+            index.d.ts
+            index.d.mts
+            src
 
   publish:
     needs: build
@@ -61,4 +84,4 @@ jobs:
       - name: Update npm to latest (trusted publishing requires npm >= 11.5.1)
         run: npm install -g npm@latest
       - name: Publish to npm
-        run: npm publish --provenance --access public
+        run: npm publish --provenance --access public

.github/workflows/pull-request.yml

@@ -3,42 +3,128 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node: [12.16.3]
-    name: Node ${{ matrix.node }}
-    steps:
-      - name: "Checkout latest code"
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-      - name: Set up node
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node }}
-      - name: Install dependencies
-        run: npm ci
-      - name: Build
-        run: npm run build
-      - name: Run tests
-        run: npm run test
+# Every job only reads the repo and moves artifacts between jobs; none of them
+# needs write access to anything.
+permissions:
+  contents: read
 
-  lint:
-    name: "ESLint"
+env:
+  # tsdown requires Node ^22.18.0 || >=24.11.0. This is the *build* toolchain
+  # only — see the `pack-smoke` job for the versions the published package
+  # itself has to keep working on.
+  BUILD_NODE_VERSION: "24"
+
+jobs:
+  build:
+    name: "Build & test"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout latest code
         uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Set up node
         uses: actions/setup-node@v4
         with:
-          node-version: "16"
+          node-version: ${{ env.BUILD_NODE_VERSION }}
+          cache: pnpm
+
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
+
       - name: Run ESLint
-        run: npm run lint:check
+        run: pnpm lint:check
+
+      - name: Build
+        run: pnpm build
+
+      - name: Run tests
+        run: pnpm test
+
+      # package.json intentionally carries no `version` — it is stamped at
+      # release time by publish.yml. `npm pack` needs one, so use a throwaway.
+      - name: Pack
+        run: |
+          npm version 0.0.0-ci --no-git-tag-version --allow-same-version
+          mkdir -p tarball
+          npm pack --pack-destination ./tarball
+
+      - name: Upload package tarball
+        uses: actions/upload-artifact@v4
+        with:
+          name: package-tarball
+          path: tarball/*.tgz
+
+  pack-smoke:
+    # Installs the packed tarball and exercises every documented entry point.
+    # bowser publishes ES5 artifacts and has no `engines` field, so the package
+    # must keep working far below the version we build on.
+    name: "Consumer smoke (Node ${{ matrix.node }})"
+    needs: build
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ["12.16.3", "14", "18", "20", "24"]
+    steps:
+      - name: Checkout latest code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Download package tarball
+        uses: actions/download-artifact@v4
+        with:
+          name: package-tarball
+          path: tarball
+
+      - name: Set up node
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+
+      # No install step: bowser has no runtime dependencies and the smoke test
+      # only uses Node built-ins, so this runs on every version above.
+      - name: Run package smoke test
+        run: node test/package/smoke.cjs tarball/*.tgz
+
+  package-lint:
+    name: "Package manifest"
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout latest code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Set up node
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.BUILD_NODE_VERSION }}
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build
+
+      - name: Stamp a throwaway version
+        run: npm version 0.0.0-ci --no-git-tag-version --allow-same-version
+
+      - name: publint
+        run: pnpm exec publint
+
+      # Scoped to the root entrypoint. The legacy `bowser/src/*` subpaths are
+      # untyped ESM sources in a CJS package — true on every published version
+      # of bowser, and preserved here on purpose.
+      - name: Are the types wrong?
+        run: pnpm exec attw --pack . --profile node16 --entrypoints .