ci: Publish npm packages

[khvn26]

Contributes to #47.

In this PR, we publish @flagsmith/cli and six platform packages from the release workflow, using goreleaser-npm-publisher over the GoReleaser dist/ output.

Auth is npm trusted publishing (OIDC).

Groundwork already done outside this PR:

• The six platform packages are bootstrapped on npm at 0.0.0 placeholders (npm requires a package to exist before trusted publishing can be configured).
• All seven packages have a trusted publisher configured for Flagsmith/flagsmith-cli + release.yml via npm trust. The stale publish.yml config on @flagsmith/cli (v1 oclif era) was revoked.

The tool is built from a pinned fork commit because upstream derives the package and command names from the GoReleaser project_name, which cannot express package @flagsmith/cli + command flagsmith.

We'll npm deprecate @flagsmith/cli@"<2.0.0" with a docs link once 2.0.0 is released.

[coderabbitai]

Warning

Review limit reached

@khvn26, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 37 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6103a374-21ef-497a-b378-4afec9429a1d

📥 Commits

Reviewing files that changed from the base of the PR and between f3e066e and 91fdab8.

📒 Files selected for processing (1)

• .github/workflows/release.yml

📝 Walkthrough

Walkthrough

The release workflow now sets up Node.js 24. It builds a pinned version of goreleaser-npm-publisher from source. It publishes the cli npm package with the flagsmith binary, package metadata, and specified files.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟠 High · up to f3e06

The release workflow currently combines publish credentials with third-party dependency installation and builds, which could allow unauthorized package publication, and the generated package metadata may prevent trusted publishing from succeeding. These issues should be fixed before merging.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b6836a10-3cde-4e35-b34a-96812e297b75

📥 Commits

Reviewing files that changed from the base of the PR and between c0a5cec and f3e066e.

📒 Files selected for processing (1)

• .github/workflows/release.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.