From f47c5776481ca5f8a94543caf5dfda4e23648050 Mon Sep 17 00:00:00 2001 From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com> Date: Fri, 21 Aug 2026 01:22:12 +0200 Subject: [PATCH] =?UTF-8?q?chore(release):=200.1.1=20=E2=80=94=20reconcile?= =?UTF-8?q?=20releases,=20publish=20via=20trusted=20publishing?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ports ai-forms' publish reconciler: merging a version bump to main is the whole release. The workflow (on push, hourly, or by hand) asks the registry whether package.json's version exists and publishes it if not — idempotent, and immune to the tag-pushed-by-GITHUB_TOKEN trigger gap. Auth is OIDC via the package's Trusted Publisher (this repo + publish.yml), so no npm token exists to leak or expire. The bump to 0.1.1 makes the merge itself prove the tokenless path live. Co-Authored-By: Claude Fable 5 --- .github/workflows/publish.yml | 26 ++++++++++---------------- package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 13 insertions(+), 19 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 49c5667..362f504 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -12,17 +12,14 @@ on: push: branches: [main] tags: ['v*'] - # The reconciler, and the reason this is reliable. A merge made with - # GITHUB_TOKEN (auto-merge, or any bot) starts no workflow, so the push - # trigger above silently does not fire for exactly the merges that matter. - # This repo has no auto-merge today, which is precisely why the schedule - # belongs here now rather than after it is added and a release goes missing. - # - # The schedule asks the registry the same idempotent question on a timer: - # is package.json's version published? A release missed by any means goes - # out within the hour without anyone noticing it was missed. + # The reconciler, and the reason this is reliable. A merge made by auto-merge + # uses GITHUB_TOKEN, and a push with that token starts no workflow — so the + # push trigger above silently does not fire for exactly the merges that matter. + # The schedule asks the registry the same idempotent question on a timer: is + # package.json's version published? If a release was missed by any means, it + # goes out within the hour without anyone noticing it was missed. schedule: - - cron: '17 * * * *' + - cron: '43 * * * *' workflow_dispatch: jobs: @@ -64,14 +61,11 @@ jobs: - if: steps.check.outputs.publish == 'true' run: npm run verify - # Bootstrap auth. Trusted publishing (OIDC) needs no token and is the - # destination; until it is configured on the package, NPM_TOKEN is what - # authenticates. The token expires — token-health.yml warns before it does, - # rather than letting a release be the thing that discovers it. + # Auth is trusted publishing (OIDC): npm accepts this job's identity token + # because the package's Trusted Publisher is pinned to exactly this repo + # and workflow. No npm token exists anywhere, so none can leak or expire. - if: steps.check.outputs.publish == 'true' run: npm publish - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Tag the released commit if: steps.check.outputs.publish == 'true' diff --git a/package-lock.json b/package-lock.json index 58e6cf3..e1e72fb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "threadkit", - "version": "0.1.0", + "version": "0.1.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "threadkit", - "version": "0.1.0", + "version": "0.1.1", "license": "MIT", "devDependencies": { "@eslint/js": "^9.39.5", diff --git a/package.json b/package.json index 1bb9770..32d6704 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "threadkit", - "version": "0.1.0", + "version": "0.1.1", "description": "Headless multi-participant message threads. Permission is participation, unread is per-person, and an AI can be a participant subject to the same visibility rules as everyone else.", "license": "MIT", "author": "Mao Nakamoto",