Skip to content

chore(ci): stop this fork from publishing over the real @wave-av/adk #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yakimoto wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(ci): stop this fork from publishing over the real @wave-av/adk #64

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 33 additions & 4 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,23 @@
name: Publish to npm

# DISABLED TRIGGER — this repo does NOT publish @wave-av/adk.
#
# The package on npm is built from wave-av/sdks → sdk-typescript/packages/adk (currently 1.0.14).
# This repo sits at 1.0.2 and is a stale fork: single-entry build, no ERROR-CODES.md, and none of the
# six subpath exports (@wave-av/adk/tools, /agents, /adapters, /templates, /types) that the shipped
# package builds and that consumers import.
#
# The trigger was `push: tags: ['v*']`. Left enabled, a version bump plus a tag here would publish a
# single-entry build OVER a package whose consumers rely on those subpaths — a breaking release
# shipped by accident, from a repo nobody realised was live.
#
# Now `workflow_dispatch` only, so it cannot fire on its own. If wave-av/sdks#42 concludes that THIS
# repo should be the home, restore the tag trigger — but sync forward from 1.0.14 first, or the first
# publish re-buries twelve versions of work.
#
# See wave-av/sdks#42.
on:
push:
tags: ['v*']
workflow_dispatch:

permissions:
contents: read
Expand All @@ -11,9 +26,10 @@ jobs:
publish:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
# SHA-pinned to match .github/workflows/lint.yml — a mutable tag can be silently repointed.
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

- uses: actions/setup-node@v4
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: '22'
registry-url: 'https://registry.npmjs.org'
Expand All @@ -22,6 +38,19 @@ jobs:

- run: npm run build

# Belt and braces: even a deliberate manual dispatch must not clobber the real package. Refuse
# any version that is not strictly ahead of what npm already serves.
- name: Refuse to publish behind the registry
run: |
local_v=$(node -p "require('./package.json').version")
published_v=$(npm view @wave-av/adk version 2>/dev/null || echo "0.0.0")
echo "local=$local_v published=$published_v"
newest=$(printf '%s\n%s\n' "$local_v" "$published_v" | sort -V | tail -1)
if [ "$local_v" = "$published_v" ] || [ "$newest" != "$local_v" ]; then
echo "::error::refusing to publish $local_v — npm already serves $published_v. This repo is a stale fork (see wave-av/sdks#42)."
exit 1
fi

- run: npm publish --access public --no-provenance
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
Loading