feat(release): align main — npm publishing path for all eight packages - #224
Merged
Conversation
Seven of the eight public packages had no automated way to reach the registry. `sdk-cli-release.yml` publishes `src/sdk/cli` and nothing else; `ci-cd.yml`'s `publish-npm` published the same directory again, with `--tag beta`, no provenance, and the token written into a .npmrc via `npm config set`. Everything else — including @beyondnet/evolith-mcp, which carries the 2026-07-23 security wave — was published by hand from a developer machine. That is why all eight versions on the registry have no `dist.attestations` (GT-570). Adds `.harness/scripts/release/plan-npm-release.mjs`: the decision of WHAT to publish, deliberately separated from the workflow so it is inspectable and testable without a registry, a token or a runner. Topological order over the internal `@beyondnet/evolith-*` edges, so a consumer never publishes before something it resolves from the registry. Idempotent — a version already on the registry is skipped, so a partial failure resumes without republishing. Never vacuous — resolving zero packages throws rather than emitting an empty plan. Pure core, I/O at the edges. 11 unit tests including a negative case for the empty set and one asserting a cycle throws instead of yielding a guessed order. Adds `.github/workflows/npm-release.yml`: all eight workspaces, dependency order, `--provenance` with `id-token: write`. `dry_run` defaults to **true**, and that is the point. The audit's finding was that this path had never run end to end; a rehearsable mode is how that stops being true without betting a registry version on the first attempt. The dry run resolves, builds, packs and reports tarball contents — it just does not publish. Other properties chosen on purpose: the token travels via NODE_AUTH_TOKEN, never `npm config set`; after publishing, the version is verified against the registry rather than trusted from an exit code; a failure stops before the failed package's consumers; the planner self-test runs on the runner before the planner is trusted; and mcp-server is rebuilt from a deleted tsbuildinfo, because `nest build` exits 0 while emitting nothing when that file is stale and an empty package is not something to discover after publishing. Retires `publish-npm` from ci-cd.yml, with the reasoning left in place. Already surfaced by running the planner against the real registry: @beyondnet/evolith-sdk is 2.0.0 in the tree and was never published — the monorepo fracture the audit described, now measured. cli and mcp-server pin ^1.1.0 and resolve the registry tarball. No version was bumped here. This commit builds the path; shipping 1.2.0 is a separate, deliberate act. Verified: planner tests 11/11, `plan-npm-release.mjs` against the live registry, both workflows parse, 40-validate-path-literals 117 literals / 203 files exit 0, ci-runner governance 17/17 exit 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ment feat(release): build the npm publishing path for all eight packages
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📊 Bilingual Coverage ImpactPR Changes
Repository Coverage
✅ Good: All EN changes have ES counterparts. Generated by GitHub Actions |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aligns
mainwithdevelop. Carries the npm publishing path (GT-570): planner with 11 unit tests including a negative case, workflow publishing all eight workspaces in dependency order with --provenance, dry_run defaulting to true, and the retirement of ci-cd.yml's publish-npm which shipped only the CLI with --tag beta and no provenance. No version is bumped. The workflow must reach the default branch before workflow_dispatch can rehearse it.🤖 Generated with Claude Code