release

From the repository root, after set-version.ts, run:

releaseVersion=$(node -p "require('./packages/core/package.json').version")
releaseTag="remotion-release-$(printf '%s' "$releaseVersion" | tr . -)"
releaseManifest="/tmp/remotion-release-${releaseVersion}-packages.txt"
bun publish.ts --list > "$releaseManifest"

The manifest is the exact package list to check and promote. Record each package's previous latest tag so a partial promotion can be rolled back.

Check whether any package in the manifest is being published to npm for the first time. Bun adds latest to a package's initial publish even with --tag. If there are new packages, stop before the bulk publish and plan their first publication separately; this flow cannot keep their first version off latest.

Run NPM_CONFIG_TOKEN=<token> bun publish.ts --tag="$releaseTag" with the token created above. Bun still packs the packages and rewrites workspace: and catalog: dependencies. This tagged path does not tolerate republish errors. A successful upload is not proof that npm's scan is finished: check the manifest, exact package versions, and temporary tags. Do not upload the same version again while its scan is pending. If a publish attempt failed and the version is confirmed absent, resume that package alone with bun publish.ts --tag="$releaseTag" --only=<package> using the same token; never rerun the entire manifest blindly.

For each package in the manifest, require npm view <package>@<version> version --json and a successful npm pack <package>@<version> --pack-destination <temporary-directory> before promotion. The pack check confirms the tarball can actually be fetched. Poll unresolved packages about once per minute; use the npm lifecycle status API where available: GET https://registry.npmjs.org/-/package/<encoded-package-name>/version/<version>/status, authenticated with publish access. URL-encode scoped names, such as @remotion%2Fwhisper-web, and keep credentials out of logs. If a package remains validating after an hour, report the release as pending and leave every latest tag on the prior release. Blocked, rejected, manual-review, missing, and unknown states also stop promotion; investigate them rather than treating them as scanning delays.

Once all packages are installable, use the release token through NPM_CONFIG_TOKEN to run npm dist-tag add <package>@<version> latest for every package in the manifest. This is one registry operation per package; npm has no atomic multi-package promotion. Verify that npm view <package> dist-tags.latest equals the release version for every package. If promotion fails partway, restore the recorded previous latest tags for packages already changed and report the incomplete release. After a successful promotion, remove the temporary tag from each package with npm dist-tag rm <package> <releaseTag> and verify the final tags.

If npm explicitly returns E_STAGE_REQUIRED, direct publishing is unavailable for that package. Stop this release and assess a staged workflow separately; staged approval requires a 2FA action per package. Do not silently mix a staged package into this direct-publish flow.