fix(release): lint native packages before publish - #1073

@coderabbitai please review this PR.

This updates the native optional package publish lifecycle so each subpackage runs clean-pkg-json and publint after verifying its staged binary.

No actionable comments were generated in the recent review. 🎉

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

#!/bin/bash
# Get the PR diff and details
gh pr view 1073 --repo ryoppippi/ccusage --json title,body,files,additions,deletions,changedFiles

echo "=== PR diff ==="
gh pr diff 1073 --repo ryoppippi/ccusage

#!/bin/bash
# Look at the catalog configuration in pnpm-workspace.yaml
cat pnpm-workspace.yaml 2>/dev/null || echo "pnpm-workspace.yaml not found"

echo "=== One full native package.json for context ==="
cat packages/ccusage-darwin-arm64/package.json

echo "=== verify-native-package.mjs script ==="
cat apps/ccusage/scripts/verify-native-package.mjs

echo "=== Main package prepack for comparison ==="
cat apps/ccusage/package.json | python3 -c "import sys, json; d=json.load(sys.stdin); print(json.dumps(d.get('scripts', {}), indent=2))"

@ryoppippi This is a clean, well-structured improvement to the native package publish lifecycle. Here's my review:

Review Summary

All 6 native packages (darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64) receive identical, consistent changes. No issues found — everything looks correct.

✅ What looks good

prepack script ordering

verify-native-package.mjs && clean-pkg-json && publint

The order is logical and intentional:

1. Verify binary first — fail-fast if the staged binary isn't present or isn't executable.
2. clean-pkg-json — strips devDependencies and other dev-only fields from the manifest in-place.
3. publint — validates the cleaned manifest (i.e., exactly what will be published). This is the correct order.

Catalog references are valid
Both "clean-pkg-json": "catalog:release" and "publint": "catalog:lint" correctly map to entries already defined in pnpm-workspace.yaml. The lockfile is updated accordingly.

"type": "commonjs" is the right call
These packages only ship a binary (bin/ccusage) with no JavaScript entrypoints. Without a type field, publint emits noise about ambiguous module type. Setting commonjs cleanly silences those warnings without misrepresenting anything.

Windows compatibility
The && chain is safe because shellEmulator: true is set in the workspace config, which pnpm uses to emulate POSIX shell syntax on Windows.

devDependencies won't leak into published packages
clean-pkg-json strips them before the tarball is packed, so the added devDependencies block serves only the local lifecycle and won't appear on npm.

Consistent with the main package's pattern
The main apps/ccusage prepack already uses clean-pkg-json. This PR brings the native subpackages in line — and goes a step further by adding publint as well.

No issues found. This is a solid, minimal, and well-reasoned improvement to the release pipeline. ✅

[approve]

Open in StackBlitz

npx https://pkg.pr.new/ryoppippi/ccusage@1073

npx https://pkg.pr.new/ryoppippi/ccusage/@ccusage/ccusage-darwin-arm64@1073

npx https://pkg.pr.new/ryoppippi/ccusage/@ccusage/ccusage-darwin-x64@1073

npx https://pkg.pr.new/ryoppippi/ccusage/@ccusage/ccusage-linux-arm64@1073

npx https://pkg.pr.new/ryoppippi/ccusage/@ccusage/ccusage-linux-x64@1073

npx https://pkg.pr.new/ryoppippi/ccusage/@ccusage/ccusage-win32-arm64@1073

npx https://pkg.pr.new/ryoppippi/ccusage/@ccusage/ccusage-win32-x64@1073

commit: 484a7da

ccusage performance comparison

PR SHA: 484a7da30b72
Base SHA: 5f6410cef124

This compares the Rust PR release binary against the configured base package on the same CI runner.

Package runner startup

Execution setup measures any pre-benchmark package materialization used by the execution benchmark. Bunx temp cache measures one bunx -p <url> ccusage --version run with an empty Bun install cache. Warm reuses that cache and reports the median of repeated runs.

Cached bunx execution performance

Runs the same large fixture through bunx -p <pkg.pr.new URL> ccusage after the Bun install cache has already been populated by the startup measurement. This separates cached package-runner execution from first-fetch package materialization.

Fixtures: Claude /home/runner/work/_temp/ccusage-large-fixture (1.01 GiB, 2,597 files), Codex /home/runner/work/_temp/ccusage-large-codex-fixture (1.01 GiB, 2,597 files)
Base package: 5f6410cef124; PR package: 484a7da30b72. Both run through bunx -p <pkg.pr.new URL> ccusage using the warmed Bun install cache from package runner startup, measured by hyperfine with 0 warmups and 1 runs.

Package runtime diagnostics

Compares the PR package wrapper, the installed native optional dependency binary, and the workspace release binary on the same large fixture. This identifies whether slow package results come from JavaScript wrapper overhead, the published native binary build, or the Rust core itself.

Fixtures: Claude /home/runner/work/_temp/ccusage-large-fixture (1.01 GiB, 2,597 files), Codex /home/runner/work/_temp/ccusage-large-codex-fixture (1.01 GiB, 2,597 files)
All rows run --offline --json, measured by hyperfine with 0 warmups and 1 runs. This isolates wrapper overhead from the installed native optional dependency and the workspace release binary built on the runner.

Committed fixture performance

Committed small fixtures for stable PR-to-PR feedback and explicit Claude/Codex command coverage.

Fixtures: Claude apps/ccusage/test/fixtures/claude (0.00 MiB, 2 files), Codex apps/ccusage/test/fixtures/codex (0.00 MiB, 1 files)
Base runs the published ccusage package from pkg.pr.new, installed before measurement; PR runs rust/target/release/ccusage directly. Both run --offline --json, measured by hyperfine with 2 warmups and 7 runs.

Large real-world-shaped fixture performance

Generated fixtures shaped from aggregate local log statistics: thousands of JSONL files, many small sessions, and a long tail of larger sessions. No real prompts, paths, or outputs are stored in the fixtures.

Fixtures: Claude /home/runner/work/_temp/ccusage-large-fixture (1.01 GiB, 2,597 files), Codex /home/runner/work/_temp/ccusage-large-codex-fixture (1.01 GiB, 2,597 files)
Base runs the published ccusage package from pkg.pr.new, installed before measurement; PR runs rust/target/release/ccusage directly. Both run --offline --json, measured by hyperfine with 0 warmups and 1 runs.

Artifact size

Lower medians and smaller artifacts are better. CI runner noise still applies; use same-run ratios as directional PR feedback, not release guarantees.

ccusage performance comparison

PR SHA: 484a7da30b72
Base SHA: 5f6410cef124

This compares the PR package against the configured base package on the same CI runner.

Package runner startup

Execution setup measures any pre-benchmark package materialization used by the execution benchmark. Bunx temp cache measures one bunx -p <url> ccusage --version run with an empty Bun install cache. Warm reuses that cache and reports the median of repeated runs.

Cached bunx execution performance

Runs the same large fixture through bunx -p <pkg.pr.new URL> ccusage after the Bun install cache has already been populated by the startup measurement. This separates cached package-runner execution from first-fetch package materialization.

Fixtures: Claude /home/runner/work/_temp/ccusage-large-fixture (1.01 GiB, 2,597 files), Codex /home/runner/work/_temp/ccusage-large-codex-fixture (1.01 GiB, 2,597 files)
Base package: 5f6410cef124; PR package: 484a7da30b72. Both run through bunx -p <pkg.pr.new URL> ccusage using the warmed Bun install cache from package runner startup, measured by hyperfine with 0 warmups and 1 runs.

Package runtime diagnostics

Compares the PR package wrapper, the installed native optional dependency binary, and the workspace release binary on the same large fixture. This identifies whether slow package results come from JavaScript wrapper overhead, the published native binary build, or the Rust core itself.

Fixtures: Claude /home/runner/work/_temp/ccusage-large-fixture (1.01 GiB, 2,597 files), Codex /home/runner/work/_temp/ccusage-large-codex-fixture (1.01 GiB, 2,597 files)
All rows run --offline --json, measured by hyperfine with 0 warmups and 1 runs. This isolates wrapper overhead from the installed native optional dependency and the workspace release binary built on the runner.

Committed fixture performance

Committed small fixtures for stable PR-to-PR feedback and explicit Claude/Codex command coverage.

Fixtures: Claude apps/ccusage/test/fixtures/claude (0.00 MiB, 2 files), Codex apps/ccusage/test/fixtures/codex (0.00 MiB, 1 files)
Base runs the published ccusage package from pkg.pr.new, installed before measurement; PR runs the published ccusage package from pkg.pr.new, installed before measurement. Both run --offline --json, measured by hyperfine with 2 warmups and 7 runs.

Large real-world-shaped fixture performance

Generated fixtures shaped from aggregate local log statistics: thousands of JSONL files, many small sessions, and a long tail of larger sessions. No real prompts, paths, or outputs are stored in the fixtures.

Fixtures: Claude /home/runner/work/_temp/ccusage-large-fixture (1.01 GiB, 2,597 files), Codex /home/runner/work/_temp/ccusage-large-codex-fixture (1.01 GiB, 2,597 files)
Base runs the published ccusage package from pkg.pr.new, installed before measurement; PR runs the published ccusage package from pkg.pr.new, installed before measurement. Both run --offline --json, measured by hyperfine with 0 warmups and 1 runs.

Artifact size

Lower medians and smaller artifacts are better. CI runner noise still applies; use same-run ratios as directional PR feedback, not release guarantees.