@_linked/server 2.3.0 → 2.3.1

package/.github/workflows/pr.yml

@@ -0,0 +1,18 @@
+name: PR
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  checks:
+    uses: linked-fw/.github/.github/workflows/pr.yml@v1
+    # The changeset reminder posts a PR comment. A reusable workflow only holds what its
+    # caller granted, and the org default is read-only.
+    permissions:
+      contents: read
+      pull-requests: write
+    with:
+      require-tests: true
+      run-e2e: false

package/.github/workflows/publish.yml

@@ -1,3 +1,8 @@
+# Calls the shared workflow in linked-fw/.github.
+#
+# This FILENAME is what npm's trusted-publisher check validates — not the shared workflow's.
+# Renaming this file invalidates this package's trusted publisher, and the only symptom is
+# that releases quietly start needing manual approval again.
 name: Publish
 
 on:
@@ -9,152 +14,17 @@ concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
   release:
-    name: Publish Release
-    runs-on: ubuntu-latest
+    uses: linked-fw/.github/.github/workflows/publish.yml@v1
     permissions:
       contents: write
       pull-requests: write
-      # `npm stage publish --provenance` signs the tarball with a GitHub OIDC token, so the
-      # job needs to be able to mint one. This does NOT switch the package to OIDC trusted
-      # publishing — authentication is still the org npm token. It only lets npm attest where
-      # the tarball was built, which is worth having on a package a human is about to approve
-      # sight-unseen.
+      # Needed HERE as well as in the shared workflow: a reusable workflow cannot widen the
+      # permissions its caller was granted, and without this npm never gets an id-token and
+      # every release silently falls back to the approval queue.
       id-token: write
-    steps:
-      # Author the changesets "Version Packages" PR as the org release App (not the default
-      # GITHUB_TOKEN) so its CI runs without a manual "Approve and run" gate. Requires the org
-      # App installed on this repo + org secrets RELEASE_APP_ID / RELEASE_APP_PRIVATE_KEY.
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v2
-        with:
-          app-id: ${{ secrets.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22.16.0
-          registry-url: 'https://registry.npmjs.org'
-
-      # `npm stage` landed in CLI 11.15.0; Node 22.16 ships npm 10.x, so the bundled one
-      # cannot stage. Pinned rather than `@latest` so a future npm release cannot change how
-      # releases behave without a commit here.
-      - name: Use an npm that can stage
-        run: npm i -g npm@^11.15.0
-
-      - name: Install dependencies
-        run: npm ci --legacy-peer-deps
-
-      - name: Build
-        run: npm run build
-
-      # No `publish:` — changesets only opens/updates the version PR here. Publishing is the
-      # step below, because `changeset publish` shells out to `npm publish`, which a
-      # stage-only token cannot do (changesets/changesets#2025 is open for first-class
-      # support). Splitting them keeps changesets doing what it is good at — versions and
-      # changelogs — and leaves the registry call to us.
-      - name: Create release Pull Request
-        id: changesets
-        uses: changesets/action@v1
-        with:
-          title: 'chore: release'
-          commit: 'chore: release'
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-
-      # Stage the version for a human to approve.
-      #
-      # A staged version is uploaded but NOT public: a maintainer reviews it and approves with
-      # 2FA, from the Staged Packages tab in the npm user menu or `npm stage approve`. That is
-      # the point — every release keeps a proof-of-presence step even though CI is
-      # unattended — and it is why the org token is scoped "read and write (stage only)".
-      #
-      # Idempotent: this workflow runs on every push to main, including the merge of the
-      # version PR and any later commit, so it must do nothing when the version is already on
-      # the registry or already sitting in the queue.
-      - name: Stage the release for approval
-        if: steps.changesets.outputs.hasChangesets != 'true'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
-        run: |
-          set -euo pipefail
-          name=$(node -p "require('./package.json').name")
-          version=$(node -p "require('./package.json').version")
-          private=$(node -p "require('./package.json').private === true")
-          if [ "$private" = "true" ]; then
-            echo "$name is private — nothing to publish."; exit 0
-          fi
-
-          if npm view "$name@$version" version >/dev/null 2>&1; then
-            echo "$name@$version is already on the registry — nothing to do."
-            exit 0
-          fi
-
-          if npm stage list "$name" 2>/dev/null | grep -q "$version"; then
-            echo "$name@$version is already staged and waiting for approval."
-            exit 0
-          fi
-
-          echo "Staging $name@$version…"
-          # Capture the output: `npm stage publish` prints the stage id, and `npm stage
-          # approve` takes ONLY that id — a package spec is rejected with "stage-id must be a
-          # valid UUID". Without this the notice below hands out a command that does not work.
-          out=$(npm stage publish --access public --provenance 2>&1 | tee /dev/stderr)
-          uuid='[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
-          # `|| true` because the script runs under `set -euo pipefail`: a grep that matches
-          # nothing exits 1 and would fail the step even though the staging itself succeeded.
-          stage_id=$(printf '%s' "$out" | grep -oE "$uuid" | tail -1 || true)
-
-          {
-            echo "### 📦 \`$name@$version\` is staged, not published"
-            echo
-            echo "It is uploaded and held for review. **Approve it to make it public:**"
-            echo
-            if [ -n "$stage_id" ]; then
-              echo "- **CLI:** \`npm stage approve $stage_id\`"
-            else
-              echo "- **CLI:** \`npm stage list $name\` to find the id, then"
-              echo "  \`npm stage approve <stage-id>\`"
-            fi
-            echo "- **Web:** [npmjs.com](https://www.npmjs.com) → your avatar → **Staged"
-            echo "  Packages** → **Approve**. The button stays disabled until npm has"
-            echo "  finished scanning the tarball; the page refreshes every minute."
-            echo
-            echo "Both prompt for 2FA. Until then \`npm install $name\` still resolves"
-            echo "\`$(npm view "$name" version 2>/dev/null || echo 'nothing')\`."
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          if [ -n "$stage_id" ]; then
-            echo "::notice title=Approval needed::$name@$version is staged. Run: npm stage approve $stage_id"
-          else
-            echo "::notice title=Approval needed::$name@$version is staged, but the stage id could not be read from the output. Run: npm stage list $name"
-          fi
-
-      # When changesets opened/updated the version PR, merge it so the release reaches the
-      # staging queue without a manual click. App token → the merge's push re-triggers this
-      # workflow, which then stages. DIRECT-merge (not `--auto`): GitHub
-      # auto-merge ignores branch-protection review-bypass allowances; main is check-only so a
-      # direct merge lands once the required check is green — retry until then.
-      - name: Merge the version PR to stage the release
-        if: steps.changesets.outputs.hasChangesets == 'true'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          pr=$(gh pr list --base main --head changeset-release/main --state open --json number --jq '.[0].number // empty')
-          if [ -z "$pr" ]; then echo "No open version PR (nothing to merge)."; exit 0; fi
-          for i in $(seq 1 40); do
-            if gh pr merge "$pr" --merge 2>/tmp/merge_err; then
-              echo "Merged version PR #$pr on attempt $i."
-              exit 0
-            fi
-            echo "Attempt $i/40: version PR #$pr not mergeable yet ($(tr -d '\n' < /tmp/merge_err)); waiting for the required check…"
-            sleep 15
-          done
-          echo "::warning::Version PR #$pr not merged after retries — merge it manually."
+    # Named rather than `inherit`: `inherit` forwards everything this repo can see, which is
+    # how a community repo would end up forwarding a first-party token.
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+      RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @\_linked/server
 
+## 2.3.1
+
+### Patch Changes
+
+- [#40](https://github.com/linked-fw/server/pull/40) [`804851d`](https://github.com/linked-fw/server/commit/804851d16f005b56893c73561aaf72ad64a78434) Thanks [@flyon](https://github.com/flyon)! - Point `repository.url` at the linked-fw organisation, so npm provenance verification matches the repository that builds the package.
+
 ## 2.3.0
 
 ### Minor Changes

package/package.json

@@ -8,9 +8,9 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/linked-cm/server.git"
+    "url": "git+https://github.com/linked-fw/server.git"
   },
-  "version": "2.3.0",
+  "version": "2.3.1",
   "linkedPackage": true,
   "type": "module",
   "main": "lib/esm/index.js",

package/.github/workflows/changeset-check.yml

@@ -1,44 +0,0 @@
-name: Changeset Check
-
-on:
-  pull_request:
-    branches:
-      - main
-
-jobs:
-  changeset-check:
-    name: Check for changeset
-    # Skip the check on the automated Release PR.
-    if: ${{ github.head_ref != 'changeset-release/main' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Check for changeset files
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const { data: files } = await github.rest.pulls.listFiles({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.issue.number,
-            });
-
-            const hasChangeset = files.some(f =>
-              f.filename.startsWith('.changeset/') &&
-              f.filename.endsWith('.md') &&
-              f.filename !== '.changeset/README.md'
-            );
-
-            if (!hasChangeset) {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body: "No changeset found. If this PR should trigger a release, run `npx changeset` and commit the generated file.\n\nIf this change doesn't need a release (docs, CI config, etc.), you can ignore this message."
-              });
-              core.warning('No changeset file found in this PR.');
-            }

package/.github/workflows/ci.yml

@@ -1,43 +0,0 @@
-name: CI
-
-on:
-  pull_request:
-    branches:
-      - main
-
-jobs:
-  build-and-test:
-    name: Build & Test
-    runs-on: ubuntu-latest
-    steps:
-      - name: Detect Release PR
-        id: rpr
-        run: |
-          if [[ "${{ github.event.pull_request.head.ref }}" == "changeset-release/main" ]]; then
-            echo "is_release_pr=true" >> $GITHUB_OUTPUT
-            echo "Release PR from changesets/action detected — skipping build/test (auto-generated version+CHANGELOG only)."
-          else
-            echo "is_release_pr=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Checkout
-        if: steps.rpr.outputs.is_release_pr == 'false'
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        if: steps.rpr.outputs.is_release_pr == 'false'
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22.16.0
-
-      - name: Install dependencies
-        if: steps.rpr.outputs.is_release_pr == 'false'
-        run: npm ci --legacy-peer-deps
-
-      - name: Build
-        if: steps.rpr.outputs.is_release_pr == 'false'
-        run: npm run build
-
-      - name: Test
-        if: steps.rpr.outputs.is_release_pr == 'false'
-        run: npm test --if-present