feat: publish diffcop to npm

[BrianEstrada]

Why

Running diffcop without cloning it means bunx github:BrianEstrada/diffcop#v0.1.0 review .... Publishing to npm makes it bunx diffcop review ..., with normal version pinning and bun add --global diffcop.

Approach

• package.json: drops private, adds the npm metadata (copied from oxlint-deslopify's shape) and a files list that ships src/ without tests, plus tsconfig.json, which Bun needs to resolve the @/ imports from node_modules. typescript moves from peerDependencies to devDependencies, since npm and Bun install peers and every user would have pulled in TypeScript.
• Releases now go through the shared bun-npm-release workflow, the same one oxlint-deslopify uses: it picks the version with git-cliff, bumps package.json, prepends to CHANGELOG.md, runs bun run check, pushes chore(release): vX.Y.Z and its tag to main, publishes with npm trusted publishing (no NPM_TOKEN, provenance included) and creates the GitHub Release from CHANGELOG.md. release.yml is now only the caller, because npm's trusted publisher matches the calling workflow's file name.
• The release commit is pushed by a GitHub App, since GitHub Actions can't bypass rulesets on a personal account's repos. CHANGELOG.md is seeded with v0.1.0, and cliff.toml and the changelog script are copied from oxlint-deslopify.
• It still needs Bun at runtime (Bun.$, Bun.file), so the README says npx diffcop works only where Bun is installed. Bundling with bun build was skipped: shipping source works, as tested below.

Review focus

The release workflow, since it can only really be tested by releasing. The rest is package metadata and docs.

Verification

• npm publish --dry-run: 34 files, no tests, no warnings.
• Installed the npm pack tarball into a scratch project with bun add: diffcop --version prints 0.1.0 and diffcop review --help loads the review command through the @/ imports. TypeScript isn't installed with it.
• Bumped to 0.2.0 locally and ran bun run changelog: it prepends a 0.2.0 section above 0.1.0, the workflow's awk pulls out just that section for the notes, and a second run stops with "CHANGELOG.md already has 0.2.0". Restored afterwards.
• actionlint passes on release.yml and on the shared workflow.
• bun run check passes.

Before the first release

• Create the GitHub App (Contents: read and write), install it on this repo, add it to main's ruleset bypass list, and set the RELEASE_APP_CLIENT_ID variable and RELEASE_APP_PRIVATE_KEY secret.
• On npmjs.com, add a trusted publisher for diffcop: repository BrianEstrada/diffcop, workflow release.yml.
• If npm requires the package to exist first, run npm publish from main once by hand, then add the trusted publisher.
• Until it's on npm, the README's bunx diffcop quick start won't work.

[github-actions]

diffcop review

✅ All good

Dropped by verification (1)

Severity	Location	Issue	Verifier
Low	.github/workflows/release.yml:25-31	Main-branch guard removed from the release caller The old job had if: github.ref == 'refs/heads/main'. The new caller job has no such check, so gh workflow run release.yml --ref <branch> now depends entirely on the pinned shared workflow to refuse non-main refs. If it doesn't, the GitHub App could push a release commit and tag to main, and publish to npm, from an arbitrary branch. Re-add the if: guard on the release job to be safe.	The finding is speculative: it only fails if the external pinned shared workflow, which isn't in this repo, also lacks a main-ref check. workflow_dispatch is already limited to people with write access, and the repo shows no concrete failing path.

What we looked at

I read the diff and checked the package metadata and runtime assumptions against the repo. That covered the bin entry and its shebang, the #package.json import, tsconfig.json, and any runtime use of typescript or of files outside src/. I also read cliff.toml, the changelog script, and the new release.yml caller. I found no definite bug, but one release-safety risk is worth flagging.

Read (3): tsconfig.json, cliff.toml, package.json

Searched (3): ^#!|package\.json|git-cliff, import\.meta|__dirname|Bun\.file|from "typescript"|\.md"|\.txt" in src, typescript|bunx diffcop|bun link|github:BrianEstrada

---

_{Reviewed 1fa2af9 · 41s · 6 tool calls · 84.2K input tokens (60% cached) · 3.6K output · ~$0.19 run}