@dori-ai/dori-side-widget 1.13.95 → 1.13.96-dev.20260922123153
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -0
- package/dist/assets/{MarkdownContent-KV-fdFKB.js → MarkdownContent-t88c95Sv.js} +1 -1
- package/dist/assets/MarkdownContent-t88c95Sv.js.br +0 -0
- package/dist/assets/{MarkdownContent-KV-fdFKB.js.gz → MarkdownContent-t88c95Sv.js.gz} +0 -0
- package/dist/assets/main-ChKonFth.js +2 -0
- package/dist/assets/main-ChKonFth.js.br +0 -0
- package/dist/assets/main-ChKonFth.js.gz +0 -0
- package/dist/widget.js +1 -1
- package/dist/widget.js.br +0 -0
- package/dist/widget.js.gz +0 -0
- package/package.json +5 -1
- package/dist/assets/MarkdownContent-KV-fdFKB.js.br +0 -0
- package/dist/assets/main-cpSdjJy0.js +0 -2
- package/dist/assets/main-cpSdjJy0.js.br +0 -0
- package/dist/assets/main-cpSdjJy0.js.gz +0 -0
package/README.md
CHANGED
|
@@ -88,6 +88,23 @@ npm run publish:dev:dry
|
|
|
88
88
|
npm run publish:prod:dry
|
|
89
89
|
```
|
|
90
90
|
|
|
91
|
+
#### From CI (npm trusted publishing)
|
|
92
|
+
|
|
93
|
+
`.github/workflows/publish.yml` runs the same script on a clean runner and
|
|
94
|
+
authenticates with a per-run OIDC token instead of an npm token, so nothing
|
|
95
|
+
secret lives on a laptop and every published version carries provenance:
|
|
96
|
+
|
|
97
|
+
```bash
|
|
98
|
+
gh workflow run publish.yml -f channel=dev --ref dev -R DoriService/dori-side-widget
|
|
99
|
+
gh workflow run publish.yml -f channel=prod --ref main -R DoriService/dori-side-widget
|
|
100
|
+
```
|
|
101
|
+
|
|
102
|
+
The prod run aligns `package.json` with the highest version on the registry,
|
|
103
|
+
bumps the patch, publishes `@latest` and commits the bump back to `main`. Pull
|
|
104
|
+
before a local prod publish afterwards or the next bump collides. The
|
|
105
|
+
trusted-publisher entry on npmjs.com is keyed on the workflow filename;
|
|
106
|
+
renaming `publish.yml` breaks CI publishing until it is updated.
|
|
107
|
+
|
|
91
108
|
### Development vs Production
|
|
92
109
|
|
|
93
110
|
- **Development**: `npm run dev` - Uses direct DOM rendering for easier debugging
|