diff --git a/.changeset/README.md b/.changeset/README.md index 035b8f61f..677d07baa 100644 --- a/.changeset/README.md +++ b/.changeset/README.md @@ -108,10 +108,9 @@ because they change no publishable package. `rsc-markdown-stream: workspace:^` edge republishes it with the renderer's new caret. The scaffolder's two optional `workspace:*` peers patch-bump and republish it whenever either member of its exact release pair moves. -- `access` stays `"restricted"` at the repository level until the release - owner decides the npm package names and access policy - (`docs/preview-packages.md`). `@agent-bundle/runtime` and - `create-agent-bundle` already override it with `publishConfig.access`. +- `access` is `"public"` at the repository level, and every publishable + package uses `publishConfig.access: "public"`. The scoped + `@agent-bundle/runtime` package must keep that explicit override. ## Release flow @@ -149,5 +148,25 @@ because they change no publishable package. npm provenance (`NPM_CONFIG_PROVENANCE=true`, `id-token: write`) and creates GitHub releases and tags. +## Enabling npm publishing + +The `agent-bundle` name on npm belongs to an unrelated project. Complete a +transfer or choose a different package name, and create or confirm control of +the `@agent-bundle` npm scope, before enabling this workflow; otherwise +`changeset publish` can leave a partial four-package release. + +1. Create an npm granular access token for CI with **Read and write (publish + and stage)**, **Bypass 2FA**, and the **All packages** grant so it can + publish `agent-bundle`, `create-agent-bundle`, `rsc-markdown-stream`, and + the `@agent-bundle` scope; set it as the repository secret `NPM_TOKEN`. +2. Set the repository variable `AGENT_BUNDLE_NPM_PUBLISH=true`. +3. Merge the Version Packages pull request. + +After step 2, keep `main` unchanged until step 3: any intervening push runs +registry verification and is red while the versioned packages are absent. + +If publishing does not happen, **Verify published registry artifacts** fails +on any package version that `npm view` cannot resolve. + Until publishing is enabled, installable previews come from pkg.pr.new (`pnpm preview:publish`, `docs/preview-packages.md`). diff --git a/.changeset/config.json b/.changeset/config.json index 00847a086..b7b7be1d9 100644 --- a/.changeset/config.json +++ b/.changeset/config.json @@ -1,6 +1,6 @@ { "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json", - "access": "restricted", + "access": "public", "baseBranch": "main", "bumpVersionsWithWorkspaceProtocolOnly": true, "changedFilePatterns": ["**", "!tests/**"], diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f2d8ae8ed..35db2726e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,8 +30,8 @@ jobs: timeout-minutes: 60 env: # npm publishing is opt-in and off by default: previews ship through - # pkg.pr.new (docs/preview-packages.md) until the package-name and - # access decisions are made. Set the repository variable + # pkg.pr.new (docs/preview-packages.md) until npm ownership of the + # package names is resolved. Set the repository variable # AGENT_BUNDLE_NPM_PUBLISH=true *and* the NPM_TOKEN secret to let the # action run `pnpm release` (release gates + `changeset publish`) when # the Version Packages PR merges. While off, the action still opens and diff --git a/docs/preview-packages.md b/docs/preview-packages.md index 79efa6b44..1cbac3988 100644 --- a/docs/preview-packages.md +++ b/docs/preview-packages.md @@ -1,16 +1,14 @@ # Preview packages (pkg.pr.new) -Nothing is published to npm yet, deliberately: the current package names are -placeholders, and npm publishing is deferred until the final name is chosen -(it will then use [npm package provenance](https://docs.npmjs.com/generating-provenance-statements); -the publish step exports `NPM_CONFIG_PROVENANCE=true` and runs the packed -release gates before `changeset publish`, and only runs at all when the +Automated npm publishing is not enabled. It will use +[npm package provenance](https://docs.npmjs.com/generating-provenance-statements); +the publish step exports `NPM_CONFIG_PROVENANCE=true`, runs the packed release +gates before `changeset publish`, and only runs when the `AGENT_BUNDLE_NPM_PUBLISH` repository variable is `true` — see "How an npm -release will flow" below). Before enabling that path, the -release owner must resolve the repository-wide `"access": "restricted"` -policy for `agent-bundle`, which does not currently override it with -`publishConfig.access`. Until then -pkg.pr.new is the release channel. Every CI package-preview run publishes real, +release will flow" below. All publishable packages use public access, but the +`agent-bundle` name on npm belongs to an unrelated project; complete a transfer +or choose another name before enabling publication. Until then, pkg.pr.new is +the release channel. Every CI package-preview run publishes real, installable tarballs of all four publishable workspace packages (`agent-bundle`, `@agent-bundle/runtime`, `rsc-markdown-stream`, `create-agent-bundle`) to [pkg.pr.new](https://pkg.pr.new) diff --git a/packages/agent-bundle/README.md b/packages/agent-bundle/README.md index 3bf5db550..2e80f3d71 100644 --- a/packages/agent-bundle/README.md +++ b/packages/agent-bundle/README.md @@ -1160,6 +1160,6 @@ Run the complete local delivery gate with `pnpm check && pnpm check:release`. `pnpm pack:dry-run`, `pnpm lint:release`, and `pnpm test:packed:release`, and it does not replace `pnpm check`. `pnpm release` runs that release gate before `changeset publish`. Native Claude/Codex smokes stay intentionally opt-in and skipped in ordinary CI. -npm publishing is deferred until the release owner picks the final package name/scope; -pkg.pr.new previews are the interim channel, and the first npm release will use npm -package provenance (`publishConfig.provenance` is already set). +Automated npm publishing is opt-in; pkg.pr.new previews remain the CI release channel until the +repository owner resolves the unrelated package currently using the `agent-bundle` name and +enables it. npm releases use public access and package provenance. diff --git a/packages/agent-bundle/package.json b/packages/agent-bundle/package.json index 7068f9822..9a580723e 100644 --- a/packages/agent-bundle/package.json +++ b/packages/agent-bundle/package.json @@ -18,6 +18,7 @@ "url": "git+https://github.com/ScriptedAlchemy/agent-bundle.git" }, "publishConfig": { + "access": "public", "provenance": true }, "type": "module", diff --git a/website/docs/en/guide/distribution/preview-packages.mdx b/website/docs/en/guide/distribution/preview-packages.mdx index b7f0f67dd..ab7108da3 100644 --- a/website/docs/en/guide/distribution/preview-packages.mdx +++ b/website/docs/en/guide/distribution/preview-packages.mdx @@ -1,14 +1,12 @@ --- -description: 'The pkg.pr.new preview channel that stands in for npm: how previews are published, how to pin them, and what changes at the first npm release.' +description: 'The pkg.pr.new preview channel that stands in for npm: how previews are published, how to pin them, and how automated publishing is enabled.' --- # Preview packages -Nothing is published to npm yet, deliberately. The current package names are placeholders, and -npm publishing is deferred until the final name is chosen. Until then, **pkg.pr.new is the -release channel**: every CI package-preview run publishes real, installable tarballs of all four -publishable workspace packages to a free continuous-release registry keyed by commit SHA and pull -request. +Automated npm publishing is not enabled yet. Until it is, **pkg.pr.new is the CI release +channel**: every package-preview run publishes real, installable tarballs of all four publishable +workspace packages to a free continuous-release registry keyed by commit SHA and pull request. The install commands and the runtime pairing rule are in [Installation](../start/installation.mdx). This page is the channel itself: where previews come @@ -59,16 +57,26 @@ npx https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@