From 58f1740b1b662ff697f47b34b685304f4ad805a9 Mon Sep 17 00:00:00 2001
From: Ajeet D'Souza <98ajeet@gmail.com>
Date: Fri, 1 May 2026 02:30:27 +0530
Subject: [PATCH 01/13] test publish workflow

---
 .github/workflows/publish.yaml  | 23 +++++++++++++++++++++++
 package-lock.json               | 12 ++++++------
 packages/cel/package.json       |  2 +-
 packages/example/package.json   |  2 +-
 packages/example/src/example.ts | 11 +++++++++--
 scripts/release.js              |  5 +----
 6 files changed, 41 insertions(+), 14 deletions(-)
 create mode 100644 .github/workflows/publish.yaml

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
new file mode 100644
index 0000000..157b0f0
--- /dev/null
+++ b/.github/workflows/publish.yaml
@@ -0,0 +1,23 @@
+name: Publish Package
+
+on:
+  push:
+    # tags:
+    #   - "v*"
+
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24.5.0"
+          registry-url: "https://registry.npmjs.org"
+      - run: npm ci
+      - run: npm run release
diff --git a/package-lock.json b/package-lock.json
index 2ee8657..a2c4905 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -398,14 +398,14 @@
         "node": ">=12"
       }
     },
-    "node_modules/@bufbuild/cel": {
-      "resolved": "packages/cel",
-      "link": true
-    },
     "node_modules/@bufbuild/cel-spec": {
       "resolved": "packages/cel-spec",
       "link": true
     },
+    "node_modules/@bufbuild/empty-test-package": {
+      "resolved": "packages/cel",
+      "link": true
+    },
     "node_modules/@bufbuild/license-header": {
       "version": "0.0.4",
       "resolved": "https://registry.npmjs.org/@bufbuild/license-header/-/license-header-0.0.4.tgz",
@@ -2026,7 +2026,7 @@
       }
     },
     "packages/cel": {
-      "name": "@bufbuild/cel",
+      "name": "@bufbuild/empty-test-package",
       "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
@@ -2057,8 +2057,8 @@
       "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
-        "@bufbuild/cel": "^0.4.0",
         "@bufbuild/cel-spec": "^0.4.0",
+        "@bufbuild/empty-test-package": "^0.4.0",
         "@bufbuild/protobuf": "^2.6.2"
       }
     }
diff --git a/packages/cel/package.json b/packages/cel/package.json
index d931a0c..c32ed8e 100644
--- a/packages/cel/package.json
+++ b/packages/cel/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "@bufbuild/cel",
+  "name": "@bufbuild/empty-test-package",
   "version": "0.4.0",
   "description": "A CEL evaluator for ECMAScript",
   "keywords": [
diff --git a/packages/example/package.json b/packages/example/package.json
index 3de6082..82fc3ef 100644
--- a/packages/example/package.json
+++ b/packages/example/package.json
@@ -14,7 +14,7 @@
   "sideEffects": false,
   "dependencies": {
     "@bufbuild/protobuf": "^2.6.2",
-    "@bufbuild/cel": "^0.4.0",
+    "@bufbuild/empty-test-package": "^0.4.0",
     "@bufbuild/cel-spec": "^0.4.0"
   }
 }
diff --git a/packages/example/src/example.ts b/packages/example/src/example.ts
index 382f068..2b7afdb 100644
--- a/packages/example/src/example.ts
+++ b/packages/example/src/example.ts
@@ -12,8 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-import { celEnv, CelScalar, parse, plan, run, celMethod } from "@bufbuild/cel";
-import { strings } from "@bufbuild/cel/ext";
+import {
+  celEnv,
+  CelScalar,
+  parse,
+  plan,
+  run,
+  celMethod,
+} from "@bufbuild/empty-test-package";
+import { strings } from "@bufbuild/empty-test-package/ext";
 
 // Run a CEL expression:
 
diff --git a/scripts/release.js b/scripts/release.js
index fde1258..56b9128 100644
--- a/scripts/release.js
+++ b/scripts/release.js
@@ -39,10 +39,7 @@ npmPublish();
  *
  */
 function npmPublish() {
-  const command =
-    `npm publish --tag ${tag}` +
-    " --workspace packages/cel" +
-    " --workspace packages/cel-spec";
+  const command = `npm publish --tag ${tag}` + " --workspace packages/cel";
   execSync(command, {
     stdio: "inherit",
   });

From f4b43ace9a19fee6092e3765c47baad5bfd41316 Mon Sep 17 00:00:00 2001
From: Ajeet D'Souza <98ajeet@gmail.com>
Date: Mon, 4 May 2026 22:15:54 +0530
Subject: [PATCH 02/13] re

---
 .github/workflows/publish.yaml | 6 +++++-
 package-lock.json              | 3 ++-
 scripts/release.js             | 6 +++---
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 157b0f0..cd3072f 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -1,5 +1,9 @@
 name: Publish Package
 
+# Requires npm trusted publishing to be configured for each package.
+# Minimum versions: npm >= 11.5.1, Node.js >= 22.14.0.
+# See: https://docs.npmjs.com/trusted-publishers
+
 on:
   push:
     # tags:
@@ -17,7 +21,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: "24.5.0"
+          node-version-file: .nvmrc
           registry-url: "https://registry.npmjs.org"
       - run: npm ci
       - run: npm run release
diff --git a/package-lock.json b/package-lock.json
index a2c4905..254d3a4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -19,7 +19,8 @@
         "tsx": "^4.21.0",
         "turbo": "^2.8.1",
         "typescript": "^5.9.3"
-      }
+      },
+      "version": "0.4.0"
     },
     "node_modules/@andrewbranch/untar.js": {
       "version": "1.0.3",
diff --git a/scripts/release.js b/scripts/release.js
index 56b9128..12b9bea 100644
--- a/scripts/release.js
+++ b/scripts/release.js
@@ -23,9 +23,9 @@ import { execSync } from "node:child_process";
  * Recommended procedure:
  * 1. Set a new version with `npm run setversion 1.2.3`
  * 2. Commit and push all changes to a PR, wait for approval.
- * 3. Login with `npm login`
- * 4. Publish to npmjs.com with `npm run release`
- * 5. Merge PR and create a release on GitHub
+ * 3. Merge the PR.
+ * 4. Create a release on GitHub with tag `v1.2.3`, which triggers the
+ *    publish workflow that runs this script.
  */
 
 const tag = determinePublishTag(findWorkspaceVersion("packages"));

From 07bc5f9e996a64a8532965a9e61ed2a650cbac8c Mon Sep 17 00:00:00 2001
From: Ajeet D'Souza <98ajeet@gmail.com>
Date: Mon, 4 May 2026 22:24:17 +0530
Subject: [PATCH 03/13] re

---
 scripts/release.js | 32 +++++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/scripts/release.js b/scripts/release.js
index 12b9bea..17fbd0f 100644
--- a/scripts/release.js
+++ b/scripts/release.js
@@ -28,23 +28,45 @@ import { execSync } from "node:child_process";
  *    publish workflow that runs this script.
  */
 
-const tag = determinePublishTag(findWorkspaceVersion("packages"));
 const uncommitted = gitUncommitted();
 if (uncommitted.length > 0) {
   throw new Error("Uncommitted changes found: \n" + uncommitted);
 }
-npmPublish();
+
+const version = findWorkspaceVersion("packages");
+const expectedGitTag = `v${version}`;
+const headTags = gitHeadTags();
+if (!headTags.includes(expectedGitTag)) {
+  throw new Error(
+    `Expected git tag ${expectedGitTag} on HEAD, found: ${headTags.join(", ") || "(none)"}`,
+  );
+}
+
+npmPublish(determinePublishTag(version));
 
 /**
- *
+ * @param {string} tag
  */
-function npmPublish() {
-  const command = `npm publish --tag ${tag}` + " --workspace packages/cel";
+function npmPublish(tag) {
+  const command = `npm publish --tag ${tag} --workspace packages/cel`;
   execSync(command, {
     stdio: "inherit",
   });
 }
 
+/**
+ * @returns {string[]}
+ */
+function gitHeadTags() {
+  const out = execSync("git tag --points-at HEAD", {
+    encoding: "utf-8",
+  });
+  return out
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0);
+}
+
 /**
  * @returns {string}
  */

From f2b61454d8446b6bae46ee8066707c0899562687 Mon Sep 17 00:00:00 2001
From: Ajeet D'Souza <98ajeet@gmail.com>
Date: Mon, 4 May 2026 22:55:54 +0530
Subject: [PATCH 04/13] auto discover packages

---
 scripts/release.js | 131 +++++++++++++++++++++++++--------------------
 1 file changed, 74 insertions(+), 57 deletions(-)

diff --git a/scripts/release.js b/scripts/release.js
index 17fbd0f..124c510 100644
--- a/scripts/release.js
+++ b/scripts/release.js
@@ -12,9 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-import { readdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { existsSync } from "node:fs";
 import { execSync } from "node:child_process";
 
 /*
@@ -28,56 +25,76 @@ import { execSync } from "node:child_process";
  *    publish workflow that runs this script.
  */
 
-const uncommitted = gitUncommitted();
-if (uncommitted.length > 0) {
-  throw new Error("Uncommitted changes found: \n" + uncommitted);
-}
+gitCheckUncommitted();
 
-const version = findWorkspaceVersion("packages");
-const expectedGitTag = `v${version}`;
-const headTags = gitHeadTags();
-if (!headTags.includes(expectedGitTag)) {
-  throw new Error(
-    `Expected git tag ${expectedGitTag} on HEAD, found: ${headTags.join(", ") || "(none)"}`,
-  );
-}
+const packages = discoverPackages();
+validatePackages(packages);
 
-npmPublish(determinePublishTag(version));
+const version = packages[0].version;
+gitCheckReleaseTag(version);
+npmPublish(version);
 
 /**
- * @param {string} tag
+ * @param {string} version
  */
-function npmPublish(tag) {
-  const command = `npm publish --tag ${tag} --workspace packages/cel`;
-  execSync(command, {
+function npmPublish(version) {
+  const tag = determinePublishTag(version);
+  execSync(`npm publish --tag ${tag} --workspaces`, {
     stdio: "inherit",
   });
 }
 
 /**
- * @returns {string[]}
+ * Validate the discovered workspace packages: at least one must exist, and
+ * all must share the same version.
+ *
+ * @param {DiscoveredPackage[]} packages
  */
-function gitHeadTags() {
-  const out = execSync("git tag --points-at HEAD", {
+function validatePackages(packages) {
+  if (packages.length === 0) {
+    throw new Error("No publishable packages found");
+  }
+  const version = packages[0].version;
+  for (const pkg of packages) {
+    if (pkg.version !== version) {
+      throw new Error(
+        `Inconsistent workspace versions: ${packages[0].name}@${version} vs ${pkg.name}@${pkg.version}`,
+      );
+    }
+  }
+}
+
+/**
+ * Throws if there are uncommitted changes in the working tree.
+ */
+function gitCheckUncommitted() {
+  const out = execSync("git status --short", {
     encoding: "utf-8",
   });
-  return out
-    .split("\n")
-    .map((line) => line.trim())
-    .filter((line) => line.length > 0);
+  if (out.trim().length > 0) {
+    throw new Error("Uncommitted changes found: \n" + out);
+  }
 }
 
 /**
- * @returns {string}
+ * Throws if the tag `v<version>` is not among the tags pointing at HEAD.
+ *
+ * @param {string} version
  */
-function gitUncommitted() {
-  const out = execSync("git status --short", {
+function gitCheckReleaseTag(version) {
+  const expected = `v${version}`;
+  const out = execSync("git tag --points-at HEAD", {
     encoding: "utf-8",
   });
-  if (out.trim().length === 0) {
-    return "";
+  const tags = out
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0);
+  if (!tags.includes(expected)) {
+    throw new Error(
+      `Expected git tag ${expected} on HEAD, found: ${tags.join(", ") || "(none)"}`,
+    );
   }
-  return out;
 }
 
 /**
@@ -101,33 +118,33 @@ function determinePublishTag(version) {
 }
 
 /**
- * @param {string} packagesDir
- * @returns {string}
+ * @typedef {{name: string; version: string}} DiscoveredPackage
  */
-function findWorkspaceVersion(packagesDir) {
-  let version = undefined;
-  for (const entry of readdirSync(packagesDir, { withFileTypes: true })) {
-    if (!entry.isDirectory()) {
+
+/**
+ * Discover all non-private workspace packages by reading their name and
+ * version from the npm CLI.
+ *
+ * @returns {DiscoveredPackage[]}
+ */
+function discoverPackages() {
+  const out = execSync("npm pkg get name version private --workspaces --json", {
+    encoding: "utf-8",
+  });
+  const workspaces = JSON.parse(out);
+  /** @type {DiscoveredPackage[]} */
+  const packages = [];
+  for (const [key, value] of Object.entries(workspaces)) {
+    if (value.private === true) {
       continue;
     }
-    const path = join(packagesDir, entry.name, "package.json");
-    if (existsSync(path)) {
-      const pkg = JSON.parse(readFileSync(path, "utf-8"));
-      if (pkg.private === true) {
-        continue;
-      }
-      if (!pkg.version) {
-        throw new Error(`${path} is missing "version"`);
-      }
-      if (version === undefined) {
-        version = pkg.version;
-      } else if (version !== pkg.version) {
-        throw new Error(`${path} has unexpected version ${pkg.version}`);
-      }
+    if (typeof value.name !== "string" || value.name.length === 0) {
+      throw new Error(`workspace ${key} is missing "name"`);
     }
+    if (typeof value.version !== "string" || value.version.length === 0) {
+      throw new Error(`workspace ${key} is missing "version"`);
+    }
+    packages.push({ name: value.name, version: value.version });
   }
-  if (version === undefined) {
-    throw new Error("unable to find workspace version");
-  }
-  return version;
+  return packages;
 }

From b97c2fd18d947b1db7a0a01901df386210c70a15 Mon Sep 17 00:00:00 2001
From: Ajeet D'Souza <98ajeet@gmail.com>
Date: Mon, 4 May 2026 22:58:33 +0530
Subject: [PATCH 05/13] revert tmp changes

---
 .github/workflows/publish.yaml  |  4 ++--
 package-lock.json               | 15 +++++++--------
 packages/cel/package.json       |  2 +-
 packages/example/package.json   |  2 +-
 packages/example/src/example.ts | 11 ++---------
 5 files changed, 13 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index cd3072f..4d348d6 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -6,8 +6,8 @@ name: Publish Package
 
 on:
   push:
-    # tags:
-    #   - "v*"
+    tags:
+      - "v*"
 
 permissions:
   id-token: write # Required for OIDC
diff --git a/package-lock.json b/package-lock.json
index 254d3a4..2ee8657 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -19,8 +19,7 @@
         "tsx": "^4.21.0",
         "turbo": "^2.8.1",
         "typescript": "^5.9.3"
-      },
-      "version": "0.4.0"
+      }
     },
     "node_modules/@andrewbranch/untar.js": {
       "version": "1.0.3",
@@ -399,12 +398,12 @@
         "node": ">=12"
       }
     },
-    "node_modules/@bufbuild/cel-spec": {
-      "resolved": "packages/cel-spec",
+    "node_modules/@bufbuild/cel": {
+      "resolved": "packages/cel",
       "link": true
     },
-    "node_modules/@bufbuild/empty-test-package": {
-      "resolved": "packages/cel",
+    "node_modules/@bufbuild/cel-spec": {
+      "resolved": "packages/cel-spec",
       "link": true
     },
     "node_modules/@bufbuild/license-header": {
@@ -2027,7 +2026,7 @@
       }
     },
     "packages/cel": {
-      "name": "@bufbuild/empty-test-package",
+      "name": "@bufbuild/cel",
       "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
@@ -2058,8 +2057,8 @@
       "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
+        "@bufbuild/cel": "^0.4.0",
         "@bufbuild/cel-spec": "^0.4.0",
-        "@bufbuild/empty-test-package": "^0.4.0",
         "@bufbuild/protobuf": "^2.6.2"
       }
     }
diff --git a/packages/cel/package.json b/packages/cel/package.json
index c32ed8e..d931a0c 100644
--- a/packages/cel/package.json
+++ b/packages/cel/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "@bufbuild/empty-test-package",
+  "name": "@bufbuild/cel",
   "version": "0.4.0",
   "description": "A CEL evaluator for ECMAScript",
   "keywords": [
diff --git a/packages/example/package.json b/packages/example/package.json
index 82fc3ef..3de6082 100644
--- a/packages/example/package.json
+++ b/packages/example/package.json
@@ -14,7 +14,7 @@
   "sideEffects": false,
   "dependencies": {
     "@bufbuild/protobuf": "^2.6.2",
-    "@bufbuild/empty-test-package": "^0.4.0",
+    "@bufbuild/cel": "^0.4.0",
     "@bufbuild/cel-spec": "^0.4.0"
   }
 }
diff --git a/packages/example/src/example.ts b/packages/example/src/example.ts
index 2b7afdb..382f068 100644
--- a/packages/example/src/example.ts
+++ b/packages/example/src/example.ts
@@ -12,15 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-import {
-  celEnv,
-  CelScalar,
-  parse,
-  plan,
-  run,
-  celMethod,
-} from "@bufbuild/empty-test-package";
-import { strings } from "@bufbuild/empty-test-package/ext";
+import { celEnv, CelScalar, parse, plan, run, celMethod } from "@bufbuild/cel";
+import { strings } from "@bufbuild/cel/ext";
 
 // Run a CEL expression:
 

From 5e64cc73f7e2e55c89ed989400c953242d4ad2a7 Mon Sep 17 00:00:00 2001
From: Timo Stamm <ts@timostamm.de>
Date: Tue, 5 May 2026 19:54:33 +0200
Subject: [PATCH 06/13] Split publish workflow into discrete steps

This replaces the npm "release" script with discrete workflow steps in publish.yaml.

The workflow calling npm, npm calling a node script, and the node script calling npm again seemed a bit much. This peels off one layer of the onion. This change also allows us to reuse scripts/gh-diffcheck.js instead of reimplementing the same check in release.js.
---
 .github/workflows/publish.yaml |  7 ++++---
 package.json                   |  1 -
 scripts/release.js             | 14 --------------
 3 files changed, 4 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 4d348d6..637481a 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -10,7 +10,7 @@ on:
       - "v*"
 
 permissions:
-  id-token: write # Required for OIDC
+  id-token: write # Required for OIDC, see https://docs.npmjs.com/trusted-publishers
   contents: read
 
 jobs:
@@ -18,10 +18,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-
       - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           registry-url: "https://registry.npmjs.org"
       - run: npm ci
-      - run: npm run release
+      - run: npm run all
+      - run: node scripts/gh-diffcheck.js
+      - run: node scripts/release.js
diff --git a/package.json b/package.json
index 1ee9136..df749eb 100644
--- a/package.json
+++ b/package.json
@@ -5,7 +5,6 @@
     "all": "turbo run --ui tui build format lint test attw license-header update-readme",
     "setversion": "node scripts/set-workspace-version.js",
     "postsetversion": "npm run all",
-    "release": "npm run all && node scripts/release.js",
     "format": "biome format --write",
     "license-header": "license-header --ignore 'packages/**'",
     "lint": "biome lint --error-on-warnings"
diff --git a/scripts/release.js b/scripts/release.js
index 124c510..4c2e459 100644
--- a/scripts/release.js
+++ b/scripts/release.js
@@ -25,8 +25,6 @@ import { execSync } from "node:child_process";
  *    publish workflow that runs this script.
  */
 
-gitCheckUncommitted();
-
 const packages = discoverPackages();
 validatePackages(packages);
 
@@ -64,18 +62,6 @@ function validatePackages(packages) {
   }
 }
 
-/**
- * Throws if there are uncommitted changes in the working tree.
- */
-function gitCheckUncommitted() {
-  const out = execSync("git status --short", {
-    encoding: "utf-8",
-  });
-  if (out.trim().length > 0) {
-    throw new Error("Uncommitted changes found: \n" + out);
-  }
-}
-
 /**
  * Throws if the tag `v<version>` is not among the tags pointing at HEAD.
  *

From f6d5fc2a0e50a1302cc5b4c98a9cb22d5b510b9b Mon Sep 17 00:00:00 2001
From: Ajeet D'Souza <98ajeet@gmail.com>
Date: Wed, 6 May 2026 02:31:41 +0530
Subject: [PATCH 07/13] re

---
 .github/workflows/publish.yaml | 18 ++++++++++++------
 scripts/release.js             |  2 +-
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 637481a..6b5c297 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -17,12 +17,18 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           registry-url: "https://registry.npmjs.org"
-      - run: npm ci
-      - run: npm run all
-      - run: node scripts/gh-diffcheck.js
-      - run: node scripts/release.js
+      - name: Install dependencies
+        run: npm ci
+      - name: Run all checks
+        run: npm run all
+      - name: Check for uncommitted changes
+        run: node scripts/gh-diffcheck.js
+      - name: Publish packages
+        run: node scripts/release.js
diff --git a/scripts/release.js b/scripts/release.js
index 4c2e459..23c47d8 100644
--- a/scripts/release.js
+++ b/scripts/release.js
@@ -15,7 +15,7 @@
 import { execSync } from "node:child_process";
 
 /*
- * Publish cel-es
+ * Publish workspace packages to npm
  *
  * Recommended procedure:
  * 1. Set a new version with `npm run setversion 1.2.3`

From b71e31b83f55e77308ffb4b9ac9a031e1948ceaf Mon Sep 17 00:00:00 2001
From: Timo Stamm <ts@timostamm.de>
Date: Wed, 6 May 2026 01:30:26 +0200
Subject: [PATCH 08/13] Fix double read

---
 scripts/set-workspace-version.js | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/scripts/set-workspace-version.js b/scripts/set-workspace-version.js
index 0526a51..d00cbea 100755
--- a/scripts/set-workspace-version.js
+++ b/scripts/set-workspace-version.js
@@ -187,10 +187,6 @@ function readPackage(path) {
   if (typeof json !== "object" || json === null) {
     throw new Error(`Failed to parse ${path}`);
   }
-  const lock = JSON.parse(readFileSync(path, "utf-8"));
-  if (typeof lock !== "object" || lock === null) {
-    throw new Error(`Failed to parse ${path}`);
-  }
   if (!("name" in json) || typeof json.name != "string") {
     throw new Error(`Missing "name" in ${path}`);
   }
@@ -201,7 +197,7 @@ function readPackage(path) {
   } else if (!("private" in json) || json.private !== true) {
     throw new Error(`Need either "version" or "private":true in ${path}`);
   }
-  return lock;
+  return json;
 }
 
 /**

From b7f9d164363b38c760a54b302207424f530fa6ad Mon Sep 17 00:00:00 2001
From: Timo Stamm <ts@timostamm.de>
Date: Wed, 6 May 2026 01:31:33 +0200
Subject: [PATCH 09/13] Relax to accept pre-release versions

---
 scripts/set-workspace-version.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/set-workspace-version.js b/scripts/set-workspace-version.js
index d00cbea..e2c7819 100755
--- a/scripts/set-workspace-version.js
+++ b/scripts/set-workspace-version.js
@@ -17,7 +17,10 @@
 import { readFileSync, writeFileSync, existsSync, globSync } from "node:fs";
 import { dirname, join } from "node:path";
 
-if (process.argv.length !== 3 || !/^\d+\.\d+\.\d+$/.test(process.argv[2])) {
+if (
+  process.argv.length !== 3 ||
+  !/^\d+\.\d+\.\d+(-(?:alpha|beta|rc).*)?$/.test(process.argv[2])
+) {
   process.stderr.write(
     [
       `USAGE: ${process.argv[1]} <new-version>`,

From 2770965d15b14e02096e1c8db3d6d79c63277dee Mon Sep 17 00:00:00 2001
From: Timo Stamm <ts@timostamm.de>
Date: Wed, 6 May 2026 01:39:19 +0200
Subject: [PATCH 10/13] Tighten usage and explain why the script exists

---
 scripts/set-workspace-version.js | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/scripts/set-workspace-version.js b/scripts/set-workspace-version.js
index e2c7819..1e6cc87 100755
--- a/scripts/set-workspace-version.js
+++ b/scripts/set-workspace-version.js
@@ -25,10 +25,9 @@ if (
     [
       `USAGE: ${process.argv[1]} <new-version>`,
       "",
-      "Walks through all workspace packages and sets the version of each ",
-      "package to the given version.",
-      "If a package depends on another package from the workspace, the",
-      "dependency version is updated as well.",
+      "Sets the version across all workspace packages. For example 1.2.3, or 2.0.0-alpha.0.",
+      "",
+      "This script exists because `npm version` does not update cross-workspace dependency entries.",
       "",
     ].join("\n"),
   );

From 2c1a487f96d0603d4b469b4df49ba8549443bc09 Mon Sep 17 00:00:00 2001
From: Ajeet D'Souza <98ajeet@gmail.com>
Date: Wed, 6 May 2026 17:53:23 +0530
Subject: [PATCH 11/13] re

---
 .github/workflows/publish.yaml     | 18 ++++++------------
 scripts/{release.js => publish.js} |  0
 2 files changed, 6 insertions(+), 12 deletions(-)
 rename scripts/{release.js => publish.js} (100%)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 6b5c297..c4130e7 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -17,18 +17,12 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           registry-url: "https://registry.npmjs.org"
-      - name: Install dependencies
-        run: npm ci
-      - name: Run all checks
-        run: npm run all
-      - name: Check for uncommitted changes
-        run: node scripts/gh-diffcheck.js
-      - name: Publish packages
-        run: node scripts/release.js
+      - run: npm ci
+      - run: npm run all
+      - run: node scripts/gh-diffcheck.js
+      - run: node scripts/publish.js
diff --git a/scripts/release.js b/scripts/publish.js
similarity index 100%
rename from scripts/release.js
rename to scripts/publish.js

From d30b4c329290c07bfdf1397ed20bf98e68b59cd1 Mon Sep 17 00:00:00 2001
From: Ajeet D'Souza <98ajeet@gmail.com>
Date: Wed, 6 May 2026 18:44:15 +0530
Subject: [PATCH 12/13] [tmp] dry run

---
 .github/workflows/publish.yaml |  4 ++--
 package-lock.json              | 12 ++++++------
 packages/cel-spec/package.json |  2 +-
 packages/cel/package.json      |  4 ++--
 packages/example/package.json  |  6 +++---
 scripts/publish.js             |  4 ++--
 6 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index c4130e7..d31a863 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -6,8 +6,8 @@ name: Publish Package
 
 on:
   push:
-    tags:
-      - "v*"
+    # tags:
+    #   - "v*"
 
 permissions:
   id-token: write # Required for OIDC, see https://docs.npmjs.com/trusted-publishers
diff --git a/package-lock.json b/package-lock.json
index 2ee8657..9e9a3c3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2027,10 +2027,10 @@
     },
     "packages/cel": {
       "name": "@bufbuild/cel",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "license": "Apache-2.0",
       "dependencies": {
-        "@bufbuild/cel-spec": "0.4.0"
+        "@bufbuild/cel-spec": "0.4.1"
       },
       "devDependencies": {
         "expect-type": "^1.3.0",
@@ -2043,7 +2043,7 @@
     },
     "packages/cel-spec": {
       "name": "@bufbuild/cel-spec",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "license": "Apache-2.0",
       "devDependencies": {
         "@types/node": "^25.1.0",
@@ -2054,11 +2054,11 @@
       }
     },
     "packages/example": {
-      "version": "0.4.0",
+      "version": "0.4.1",
       "license": "Apache-2.0",
       "dependencies": {
-        "@bufbuild/cel": "^0.4.0",
-        "@bufbuild/cel-spec": "^0.4.0",
+        "@bufbuild/cel": "^0.4.1",
+        "@bufbuild/cel-spec": "^0.4.1",
         "@bufbuild/protobuf": "^2.6.2"
       }
     }
diff --git a/packages/cel-spec/package.json b/packages/cel-spec/package.json
index 11182f6..e7041f8 100644
--- a/packages/cel-spec/package.json
+++ b/packages/cel-spec/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bufbuild/cel-spec",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "CEL definitions and test data",
   "keywords": [
     "javascript",
diff --git a/packages/cel/package.json b/packages/cel/package.json
index d931a0c..8bfd061 100644
--- a/packages/cel/package.json
+++ b/packages/cel/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bufbuild/cel",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "A CEL evaluator for ECMAScript",
   "keywords": [
     "javascript",
@@ -51,7 +51,7 @@
     "@bufbuild/protobuf": "^2.6.2"
   },
   "dependencies": {
-    "@bufbuild/cel-spec": "0.4.0"
+    "@bufbuild/cel-spec": "0.4.1"
   },
   "devDependencies": {
     "peggy": "^5.0.6",
diff --git a/packages/example/package.json b/packages/example/package.json
index 3de6082..41083fe 100644
--- a/packages/example/package.json
+++ b/packages/example/package.json
@@ -1,7 +1,7 @@
 {
   "name": "example",
   "private": true,
-  "version": "0.4.0",
+  "version": "0.4.1",
   "license": "Apache-2.0",
   "scripts": {
     "start": "tsx src/example.ts",
@@ -14,7 +14,7 @@
   "sideEffects": false,
   "dependencies": {
     "@bufbuild/protobuf": "^2.6.2",
-    "@bufbuild/cel": "^0.4.0",
-    "@bufbuild/cel-spec": "^0.4.0"
+    "@bufbuild/cel": "^0.4.1",
+    "@bufbuild/cel-spec": "^0.4.1"
   }
 }
diff --git a/scripts/publish.js b/scripts/publish.js
index 23c47d8..d66c328 100644
--- a/scripts/publish.js
+++ b/scripts/publish.js
@@ -29,7 +29,7 @@ const packages = discoverPackages();
 validatePackages(packages);
 
 const version = packages[0].version;
-gitCheckReleaseTag(version);
+// gitCheckReleaseTag(version);
 npmPublish(version);
 
 /**
@@ -37,7 +37,7 @@ npmPublish(version);
  */
 function npmPublish(version) {
   const tag = determinePublishTag(version);
-  execSync(`npm publish --tag ${tag} --workspaces`, {
+  execSync(`npm publish --dry-run --tag ${tag} --workspaces`, {
     stdio: "inherit",
   });
 }

From eb4e2d1b28ecd3354a2c80cd82ca10fa1c89d477 Mon Sep 17 00:00:00 2001
From: Ajeet D'Souza <98ajeet@gmail.com>
Date: Wed, 6 May 2026 19:09:57 +0530
Subject: [PATCH 13/13] Revert "[tmp] dry run"

This reverts commit d30b4c329290c07bfdf1397ed20bf98e68b59cd1.
---
 .github/workflows/publish.yaml |  4 ++--
 package-lock.json              | 12 ++++++------
 packages/cel-spec/package.json |  2 +-
 packages/cel/package.json      |  4 ++--
 packages/example/package.json  |  6 +++---
 scripts/publish.js             |  4 ++--
 6 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index d31a863..c4130e7 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -6,8 +6,8 @@ name: Publish Package
 
 on:
   push:
-    # tags:
-    #   - "v*"
+    tags:
+      - "v*"
 
 permissions:
   id-token: write # Required for OIDC, see https://docs.npmjs.com/trusted-publishers
diff --git a/package-lock.json b/package-lock.json
index 9e9a3c3..2ee8657 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2027,10 +2027,10 @@
     },
     "packages/cel": {
       "name": "@bufbuild/cel",
-      "version": "0.4.1",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
-        "@bufbuild/cel-spec": "0.4.1"
+        "@bufbuild/cel-spec": "0.4.0"
       },
       "devDependencies": {
         "expect-type": "^1.3.0",
@@ -2043,7 +2043,7 @@
     },
     "packages/cel-spec": {
       "name": "@bufbuild/cel-spec",
-      "version": "0.4.1",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "devDependencies": {
         "@types/node": "^25.1.0",
@@ -2054,11 +2054,11 @@
       }
     },
     "packages/example": {
-      "version": "0.4.1",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
-        "@bufbuild/cel": "^0.4.1",
-        "@bufbuild/cel-spec": "^0.4.1",
+        "@bufbuild/cel": "^0.4.0",
+        "@bufbuild/cel-spec": "^0.4.0",
         "@bufbuild/protobuf": "^2.6.2"
       }
     }
diff --git a/packages/cel-spec/package.json b/packages/cel-spec/package.json
index e7041f8..11182f6 100644
--- a/packages/cel-spec/package.json
+++ b/packages/cel-spec/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bufbuild/cel-spec",
-  "version": "0.4.1",
+  "version": "0.4.0",
   "description": "CEL definitions and test data",
   "keywords": [
     "javascript",
diff --git a/packages/cel/package.json b/packages/cel/package.json
index 8bfd061..d931a0c 100644
--- a/packages/cel/package.json
+++ b/packages/cel/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bufbuild/cel",
-  "version": "0.4.1",
+  "version": "0.4.0",
   "description": "A CEL evaluator for ECMAScript",
   "keywords": [
     "javascript",
@@ -51,7 +51,7 @@
     "@bufbuild/protobuf": "^2.6.2"
   },
   "dependencies": {
-    "@bufbuild/cel-spec": "0.4.1"
+    "@bufbuild/cel-spec": "0.4.0"
   },
   "devDependencies": {
     "peggy": "^5.0.6",
diff --git a/packages/example/package.json b/packages/example/package.json
index 41083fe..3de6082 100644
--- a/packages/example/package.json
+++ b/packages/example/package.json
@@ -1,7 +1,7 @@
 {
   "name": "example",
   "private": true,
-  "version": "0.4.1",
+  "version": "0.4.0",
   "license": "Apache-2.0",
   "scripts": {
     "start": "tsx src/example.ts",
@@ -14,7 +14,7 @@
   "sideEffects": false,
   "dependencies": {
     "@bufbuild/protobuf": "^2.6.2",
-    "@bufbuild/cel": "^0.4.1",
-    "@bufbuild/cel-spec": "^0.4.1"
+    "@bufbuild/cel": "^0.4.0",
+    "@bufbuild/cel-spec": "^0.4.0"
   }
 }
diff --git a/scripts/publish.js b/scripts/publish.js
index d66c328..23c47d8 100644
--- a/scripts/publish.js
+++ b/scripts/publish.js
@@ -29,7 +29,7 @@ const packages = discoverPackages();
 validatePackages(packages);
 
 const version = packages[0].version;
-// gitCheckReleaseTag(version);
+gitCheckReleaseTag(version);
 npmPublish(version);
 
 /**
@@ -37,7 +37,7 @@ npmPublish(version);
  */
 function npmPublish(version) {
   const tag = determinePublishTag(version);
-  execSync(`npm publish --dry-run --tag ${tag} --workspaces`, {
+  execSync(`npm publish --tag ${tag} --workspaces`, {
     stdio: "inherit",
   });
 }