From 31078997b8033c53b41f23882cede65dcd2033aa Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 7 Nov 2026 13:46:11 +0000 Subject: [PATCH 1/3] =?UTF-8?q?Plan=20001:=20tick=20A6=20=E2=80=94=20@vers?= =?UTF-8?q?ionone/agility-sdk@1.0.0-alpha.0=20is=20on=20npmjs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016NSWj9gL1oCubj5e2anVkb --- plans/001-sdk-adoption-campaign.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plans/001-sdk-adoption-campaign.md b/plans/001-sdk-adoption-campaign.md index a87fafc..f82cbe6 100644 --- a/plans/001-sdk-adoption-campaign.md +++ b/plans/001-sdk-adoption-campaign.md @@ -475,7 +475,7 @@ ESM" here means finishing the edges: - [x] A4 slack-shaped reads — `queryV1` wire module, `client.queryV1.query`/`queries` (read-only, idempotent, same row translation as api/asset) - [x] A5 services port from gh-v1 — `resolve` (`client.resolve.numbers`/`.ref`), `guard` (`client.assets.sendGuarded`), `batch` (`client.batch.run`/`.reversible`) - [x] A7 attachments and embedded images — `attachment` wire module (`attachment.img` bytes, `EmbeddedImage.mvc/Upload`, URL helpers, browser-safe Base64), `client.attachments` (list/info/get/add/put/remove/url; inline up to `INLINE_LIMIT`, two-step above) and `client.embeddedImages` (upload/url/normalize) -- [ ] A6 CI + prerelease publish — CI, git-SHA installs, the dependency audit and the publish workflow (`.github/workflows/publish.yml`: on a `v*` tag, verify, dist-tag from the prerelease id, `npm publish --provenance`) done; version `1.0.0-alpha.0`. License decided 2026-11-07: MIT (`LICENSE`; `master`'s BSD 3-clause `LICENSE.md` stays with the 2.x code). Left: the first publish by hand and the trusted-publisher link on npmjs +- [x] A6 CI + prerelease publish — `@versionone/agility-sdk@1.0.0-alpha.0` on npmjs (2026-11-07; dist-tags `alpha` and, as npm sets on a first publish, `latest`), MIT. CI on Linux and Windows; `.github/workflows/publish.yml` publishes later versions from a `v*` tag once trusted publishing is linked on npmjs. The first version was published by hand, so it has no provenance - [x] G0–G3 gh-v1 migrations — versionone/gh-v1#29–#32 - [x] S1–S4 slack-bot migrations — digital-ai/k6i-agility-slack-bot#21–#24 (on `bolt-migration`) - [x] B1 slack bot client swap — digital-ai/k6i-agility-slack-bot#29 From 8f6ef78a7b4b4c467c4253ee4c0e290cdf482760 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 7 Nov 2026 13:53:01 +0000 Subject: [PATCH 2/3] Publish job runs in the GitHub environment npm The environment carries the approval rule (a required reviewer, v* tags only), and npm's trusted-publisher link will name it, so only an approved run in that environment can publish. README: Releasing says so. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016NSWj9gL1oCubj5e2anVkb --- .github/workflows/publish.yml | 10 +++++++--- README.md | 4 +++- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 0cb2d16..f75f68b 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -7,9 +7,9 @@ name: Publish # (alpha, beta, rc), so `npm install @versionone/agility-sdk` never picks it # up; only a plain version moves `latest`. # -# Authentication is npm trusted publishing (OIDC): link this repository and -# this workflow file on the package's npmjs settings page, and no token is -# stored anywhere. The package must exist before it can be linked, so the +# Authentication is npm trusted publishing (OIDC): on the package's npmjs +# settings, link organization versionone, repository VersionOne.SDK.JavaScript, +# workflow publish.yml and environment npm; no token is stored anywhere. The package must exist before it can be linked, so the # very first version may need one manual publish (see the README's # "Releasing" section); an NPM_TOKEN secret, if set, is used as a fallback. @@ -28,6 +28,10 @@ concurrency: jobs: publish: runs-on: ubuntu-latest + # The GitHub environment "npm" holds the approval rule (a required + # reviewer, v* tags only), and npm's trusted-publisher link names it, so + # only a run in this environment can publish. + environment: npm steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 diff --git a/README.md b/README.md index 3093997..cc398bc 100644 --- a/README.md +++ b/README.md @@ -76,7 +76,9 @@ git tag v1.0.0-alpha.1 && git push origin v1.0.0-alpha.1 ``` Authentication is npm trusted publishing: on npmjs, the package's settings -link this repository and `publish.yml`, and no token is stored. A package +link this repository, `publish.yml` and the GitHub environment `npm`, and no +token is stored. The `npm` environment (repository settings) requires an +approval, so a pushed tag waits for a maintainer before it publishes. A package must exist before it can be linked, so the very first version is published once by hand by an `@versionone` org member (`npm publish --access public --tag alpha` from a clean checkout of the tagged commit), then linked. From dfa5f829163de87e392dc787c714fe226f9e693c Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 7 Nov 2026 13:53:15 +0000 Subject: [PATCH 3/3] publish.yml: tidy the header comment Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016NSWj9gL1oCubj5e2anVkb --- .github/workflows/publish.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index f75f68b..a6ac6d4 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -9,9 +9,9 @@ name: Publish # # Authentication is npm trusted publishing (OIDC): on the package's npmjs # settings, link organization versionone, repository VersionOne.SDK.JavaScript, -# workflow publish.yml and environment npm; no token is stored anywhere. The package must exist before it can be linked, so the -# very first version may need one manual publish (see the README's -# "Releasing" section); an NPM_TOKEN secret, if set, is used as a fallback. +# workflow publish.yml and environment npm; no token is stored anywhere. +# (1.0.0-alpha.0 was published by hand, as a package must exist before it +# can be linked.) An NPM_TOKEN secret, if set, is used as a fallback. on: push: