📦 bun-monopub

A blazing fast, lightweight monorepo publish tool (requires only the Bun runtime). It works seamlessly as both a standalone GitHub Action and a local CLI utility.

🇷🇺 Читать на русском

✨ Features

• Plug & Play Action: No need to setup Node or Bun in your workflows — the action handles everything under the hood!
• Monorepo Ready: Automatically detects workspaces in your package.json and updates versions across all interconnected packages.
• OIDC Provenance: Fully supports NPM provenance (--provenance) for supply-chain security when running in GitHub Actions.
• Node-RED Integration: Automatically pings the Node-RED registry to update your palettes if "node-red" is detected in the package.json.
• Interactive TTY: Fully supports WebAuthn and 2FA via browser when publishing locally.

🚀 Usage as a GitHub Action

You can use this tool to fully automate your release process and upload the generated tarballs as workflow artifacts.

name: Release
on:
  push:
    tags:
      - 'v*'

permissions:
  id-token: write # Required for NPM provenance signature
  contents: write # Required for creating GitHub Releases

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Publish Packages
        uses: alex2844/action-bun-monopub@v1
        with:
          version: ${{ github.ref_name }}
        env:
          # Required ONLY for the first publish of a new package.
          # After the package is created, setup Trusted Publishing (OIDC)
          # in NPM settings and delete the secret from GitHub.
          # The workflow will gracefully fallback to OIDC!
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Upload Tarballs as Artifacts
        uses: actions/upload-artifact@v6
        with:
          name: npm-packages
          # Grabs all generated .tgz files from all monorepo folders
          path: '**/*.tgz'

Action Inputs

| Input | Type | Default | Description | | --- | --- | --- | --- | | version | string | "" | Target version (e.g., 1.2.3). | | access | string | "public" | NPM package access (public or restricted). | | keep-tarballs | boolean | true | Keep .tgz files after publish. | | registry-url | string | "https://registry.npmjs.org" | NPM Registry URL. |

💻 Usage as a CLI (Local)

You can run this tool locally to bump versions and publish your packages securely. It will automatically open your browser for WebAuthn/2FA checks.

Run on the fly

bunx bun-monopub 1.2.3

Install globally

bun install -g bun-monopub
bun-monopub 1.2.3 --access public

CLI Options

Usage: bun-monopub [version] [options]

Arguments:
  version              Target version (e.g. 1.2.3).
                       If omitted, reads from INPUT_VERSION env or
                       root package.json.

Options:
  -a, --access         NPM package access: 'public' or 'restricted'
                       (default: public)
  -k, --keep-tarballs  Do not delete generated .tgz files after publish
  -h, --help           Show help message
  -v, --version        Show CLI version