Skip to content

feat: add github registry support #409

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
harishsundar-okta merged 7 commits into from
Jul 27, 2026
Merged

feat: add github registry support #409

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4d764c7
feat: add github registry support (hybrid option 2)
harishsundar-okta Jul 14, 2026
af01197
chore: resolve merge conflicts with main in registry.json
harishsundar-okta Jul 21, 2026
7c11f50
chore: regenerate registry.json with react prefix and framework metadata
harishsundar-okta Jul 22, 2026
4959265
ci: add registry.json drift check to fail if catalog is stale
harishsundar-okta Jul 22, 2026
6cf4c98
fix: pin shadcn version in ci and fix deprecation headers
harishsundar-okta Jul 27, 2026
05adf97
Merge remote-tracking branch 'origin/main' into feat/github-registry-…
harishsundar-okta Jul 27, 2026
fa51b99
chore: regenerate registry.json after merge with main
harishsundar-okta Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .github/workflows/ci-cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ jobs:
ci:
name: 🔄 Continuous Integration
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
with:
Expand Down Expand Up @@ -53,6 +55,17 @@ jobs:

- name: Build packages
run: pnpm build

- name: Check registry.json is up to date
run: |
pnpm --filter @auth0/universal-components-react registry:generate
if ! git diff --exit-code packages/react/registry.json; then
echo "::error::registry.json is out of date. Run 'pnpm --filter @auth0/universal-components-react registry:generate' and commit the result."
exit 1
fi

- name: Validate shadcn registry
run: pnpm dlx shadcn@4.15.0 registry validate
notify:
name: Slack Notification
needs: [ci]
Expand Down
17 changes: 17 additions & 0 deletions .github/workflows/publish-public-npm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -305,6 +305,23 @@ jobs:
echo "Created tag: $TAG_NAME"
done

# Unified version tag for GitHub Registry consumers (npx shadcn add org/repo/item#v2.1.0)
UNIFIED_TAG="v${VERSION}"

if git rev-parse "$UNIFIED_TAG" >/dev/null 2>&1; then
echo "Tag $UNIFIED_TAG exists locally, deleting..."
git tag -d "$UNIFIED_TAG"
fi

if git ls-remote --tags origin | grep -q "refs/tags/$UNIFIED_TAG"; then
echo "Tag $UNIFIED_TAG exists remotely, deleting..."
git push origin ":refs/tags/$UNIFIED_TAG" || true
fi

git tag -a "$UNIFIED_TAG" -m "Release v${VERSION} — GitHub Registry ref"
git push origin "$UNIFIED_TAG"
Comment on lines +311 to +322

@coderabbitai coderabbitai Bot Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Keep GitHub Registry version tags immutable.

Deleting and recreating v${VERSION} can make the same installation ref resolve to different source. Fail if the release tag already exists instead of moving it.

Proposed fix 
-          if git rev-parse "$UNIFIED_TAG" >/dev/null 2>&1; then
-            echo "Tag $UNIFIED_TAG exists locally, deleting..."
-            git tag -d "$UNIFIED_TAG"
-          fi
-
-          if git ls-remote --tags origin | grep -q "refs/tags/$UNIFIED_TAG"; then
-            echo "Tag $UNIFIED_TAG exists remotely, deleting..."
-            git push origin ":refs/tags/$UNIFIED_TAG" || true
+          if git rev-parse "$UNIFIED_TAG" >/dev/null 2>&1 ||
+             git ls-remote --exit-code --tags origin "refs/tags/$UNIFIED_TAG" >/dev/null 2>&1; then
+            echo "::error::Release tag $UNIFIED_TAG already exists; refusing to move it."
+            exit 1
           fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if git rev-parse "$UNIFIED_TAG" >/dev/null 2>&1; then
echo "Tag $UNIFIED_TAG exists locally, deleting..."
git tag -d "$UNIFIED_TAG"
fi
if git ls-remote --tags origin | grep -q "refs/tags/$UNIFIED_TAG"; then
echo "Tag $UNIFIED_TAG exists remotely, deleting..."
git push origin ":refs/tags/$UNIFIED_TAG" || true
fi
git tag -a "$UNIFIED_TAG" -m "Release v${VERSION} — GitHub Registry ref"
git push origin "$UNIFIED_TAG"
if git rev-parse "$UNIFIED_TAG" >/dev/null 2>&1 ||
git ls-remote --exit-code --tags origin "refs/tags/$UNIFIED_TAG" >/dev/null 2>&1; then
echo "::error::Release tag $UNIFIED_TAG already exists; refusing to move it."
exit 1
fi
git tag -a "$UNIFIED_TAG" -m "Release v${VERSION} — GitHub Registry ref"
git push origin "$UNIFIED_TAG"
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-public-npm.yml around lines 311 - 322, Update the
release-tag flow around UNIFIED_TAG to preserve tag immutability: remove the
local and remote deletion logic, check whether the tag already exists remotely,
and fail the workflow before creating or pushing it. Continue creating and
pushing the tag only when it does not already exist.

@harishsundar-okta harishsundar-okta Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Intentional design — the delete-and-recreate behavior is needed because our publish workflow can be re-run on failure (e.g. partial npm publish). If the tag were immutable, a retry after a transient failure would require manual tag cleanup before the workflow could succeed. Since the tag always points to the same commit within a single workflow run, consumers installing by tag still get deterministic resolution for any given release.

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description image shows a dark terminal running:

npx shadcn add auth0/auth0-ui-components/react/my-account/user-mfa-management#feat/github-registry-hybrid

It installs shadcn@4.13.0, reports successful registry and dependency checks, confirms overwriting button.tsx and utils.ts, and lists “Created 60 files”, including src/components/auth/my-account/user-mfa-management.tsx and multiple MFA-related components.

@harishsundar-okta, thanks for clarifying the retry requirement. I agree that avoiding manual cleanup after a failed release is valuable.

However, a rerun is not necessarily the same workflow run or the same commit: workflow_dispatch may be invoked from a different ref, while retaining the same package version. The current delete-and-recreate flow would then move v${VERSION}, so consumers using that tag could receive different registry content over time.

The finding therefore still applies as an intentional tradeoff rather than an accidental behavior. If mutable tags are the accepted release policy, no change is needed here; documenting that policy near this block would help make the consumer-facing contract explicit.

✏️ Learnings added 
Learnt from: harishsundar-okta
Repo: auth0/auth0-ui-components PR: 409
File: .github/workflows/publish-public-npm.yml:311-322
Timestamp: 2026-07-27T10:26:18.285Z
Learning: In `.github/workflows/publish-public-npm.yml`, the unified `v${VERSION}` Git tag is intentionally deleted and recreated to support rerunning a failed public NPM publish workflow without manual tag cleanup. This intentionally trades release-tag immutability for retry convenience.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

echo "Created unified tag: $UNIFIED_TAG"

- name: Create GitHub Release for Core
if: github.event.inputs.dry_run != 'true'
uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2
Expand Down
3 changes: 3 additions & 0 deletions docs-site/api/r.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,9 @@ function sendJson(res: VercelResponse, content: string): void {
res.setHeader('Content-Type', 'application/json');
res.setHeader('Access-Control-Allow-Origin', '*');
res.setHeader('Cache-Control', 'public, max-age=3600');
res.setHeader('Deprecation', '@1798761599');
res.setHeader('Sunset', 'Thu, 31 Dec 2026 23:59:59 GMT');
res.setHeader('Link', '<https://github.com/auth0/auth0-ui-components>; rel="successor-version"');
res.send(content);
}

Expand Down
Loading
Loading