@decohere/ci-tools 0.0.1-dev.124 → 0.0.1-dev.125

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.124",
+  "version": "0.0.1-dev.125",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",

package/src/github/npm-bootstrap.mjs

@@ -1,5 +1,5 @@
 /**
- * First-publish a new package name (restricted) and give it its Trusted Publisher,
+ * First-publish a new package name (public) and give it its Trusted Publisher,
  * so `publish.yml` can release it over OIDC from then on.
  *
  *   pnpm npm:bootstrap [--otp <code>] [--dry-run] [--channel dev] [<package-name>...]
@@ -31,15 +31,15 @@ export function needsPrereleaseTag(version) {
 }
 
 /**
- * npm arguments for a name-only first publish. Restricted is the scoped default,
- * so no `--access`. `./` stops npm reading the path as a GitHub `owner/repo`.
+ * npm arguments for a name-only first publish. Scoped names default to restricted,
+ * so `--access public`. `./` stops npm reading the path as a GitHub `owner/repo`.
  *
  * @param {{ dir: string, version?: string }} pkg
  * @param {string} channel
  */
 export function publishArgs(pkg, channel) {
 	const tag = needsPrereleaseTag(pkg.version) ? ["--tag", channel] : [];
-	return ["publish", `./projects/${pkg.dir}`, ...tag];
+	return ["publish", `./projects/${pkg.dir}`, "--access", "public", ...tag];
 }
 
 /** @param {string} name */

package/src/github/oidc-bootstrap-nudge.mjs

@@ -33,7 +33,7 @@ export function firstPublishCommands(packages, channel = "dev") {
 	}
 	return packages.map((pkg) => {
 		const tag = needsPrereleaseTag(pkg.version) ? ` --tag ${channel}` : "";
-		return `npm publish ./projects/${pkg.dir}${tag}`;
+		return `npm publish ./projects/${pkg.dir} --access public${tag}`;
 	});
 }
 
@@ -95,7 +95,7 @@ export function buildDescription(options) {
 		"",
 		"That does steps 1 and 2 below, skipping what is already done. To do them by hand instead:",
 		"",
-		"1. First-publish each name **restricted** (scoped default — do **not** pass `--access public`). From a trusted machine, `npm login` to the org, then from the **repo root**. Use `./` so npm does not treat the path as a GitHub `owner/repo`. `--tag` is required for prerelease versions (`x.y.z-dev.N`). Missing `bin`/`es6` warnings are OK for this name-only bootstrap; CI `forge publish` ships the built tarball later:",
+		"1. First-publish each name **public** (`--access public`: scoped names default to restricted). From a trusted machine, `npm login` to the org, then from the **repo root**. Use `./` so npm does not treat the path as a GitHub `owner/repo`. `--tag` is required for prerelease versions (`x.y.z-dev.N`). Missing `bin`/`es6` warnings are OK for this name-only bootstrap; CI `forge publish` ships the built tarball later:",
 		"",
 		"```bash",
 		...firstPublishCommands(packages, channel),

package/tests/github/npm-bootstrap.test.mjs

@@ -58,7 +58,7 @@ afterEach(() => {
 });
 
 describe("npm-bootstrap", () => {
-	it("first-publishes unpublished names restricted, then sets the Trusted Publisher", async () => {
+	it("first-publishes unpublished names public, then sets the Trusted Publisher", async () => {
 		seedWorkspace();
 		const registry = fakeNpm({ published: ["@decohere/scribe"] });
 
@@ -67,7 +67,7 @@ describe("npm-bootstrap", () => {
 		expect(code).toBe(0);
 		expect(registry.calls).toEqual([
 			"whoami",
-			"publish ./projects/scribe/scribe-console --tag dev [otp 123456]",
+			"publish ./projects/scribe/scribe-console --access public --tag dev [otp 123456]",
 			"trust list @decohere/scribe-console --json [otp 123456]",
 			"trust github @decohere/scribe-console --file publish.yml --repo typesmiths/decohere --env npm-publish --allow-publish --yes [otp 123456]",
 		]);
@@ -107,7 +107,7 @@ describe("npm-bootstrap", () => {
 		expect(code).toBe(0);
 		expect(registry.calls).toEqual(["whoami"]);
 		expect(lines).toContain(
-			"[dry run] npm publish ./projects/scribe/scribe-console --tag dev",
+			"[dry run] npm publish ./projects/scribe/scribe-console --access public --tag dev",
 		);
 	});
 

package/tests/github/oidc-bootstrap-nudge.test.mjs

@@ -47,16 +47,15 @@ describe("oidc-bootstrap-nudge", () => {
 		expect(needsPrereleaseTag("0.0.1-dev.18")).toBe(true);
 		expect(needsPrereleaseTag("1.2.3")).toBe(false);
 		expect(firstPublishCommands([pkg], "dev")).toEqual([
-			"npm publish ./projects/scaffold --tag dev",
+			"npm publish ./projects/scaffold --access public --tag dev",
 		]);
 		expect(firstPublishCommands([{ ...pkg, version: "1.0.0" }], "dev")).toEqual([
-			"npm publish ./projects/scaffold",
+			"npm publish ./projects/scaffold --access public",
 		]);
-		expect(body).toContain("npm publish ./projects/scaffold --tag dev");
+		expect(body).toContain("npm publish ./projects/scaffold --access public --tag dev");
 		expect(body).toContain("pnpm npm:bootstrap --otp <code> @decohere/scaffold");
 		expect(body).not.toMatch(/# @decohere\/scaffold/);
-		expect(body).toContain("do **not** pass `--access public`");
-		expect(firstPublishCommands([pkg], "dev").join("\n")).not.toContain("--access public");
+		expect(body).toContain("First-publish each name **public**");
 		expect(body).toContain("Workflow filename: `publish.yml`");
 		expect(body).toContain("Environment: `npm-publish`");
 		expect(body).toContain("gh run rerun --failed");