@guiho/runx 0.2.2 → 0.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: RunX npm Trusted Publishing 0.2.2 Validation
|
|
3
|
+
purpose: Record the release checks and GitHub result for the 0.2.2 trusted-publishing retry.
|
|
4
|
+
description: Documents successful build validation and the tag-ruleset rejection that prevented the Publish workflow from starting.
|
|
5
|
+
created: 2026-07-14
|
|
6
|
+
flags: []
|
|
7
|
+
tags:
|
|
8
|
+
- validation
|
|
9
|
+
- release
|
|
10
|
+
keywords:
|
|
11
|
+
- runx
|
|
12
|
+
- npm
|
|
13
|
+
- trusted publishing
|
|
14
|
+
owner: runx-validation
|
|
15
|
+
---
|
|
16
|
+
|
|
17
|
+
# npm Trusted Publishing 0.2.2 Validation
|
|
18
|
+
|
|
19
|
+
## Result
|
|
20
|
+
|
|
21
|
+
The `0.2.2` package bump was merged to protected `main`, but GitHub rejected
|
|
22
|
+
creation of the `@guiho/runx@0.2.2` tag. Because the tag was not created, the
|
|
23
|
+
Publish workflow did not run and npm remained on `0.2.0`.
|
|
24
|
+
|
|
25
|
+
## Passed checks
|
|
26
|
+
|
|
27
|
+
- `bun run typecheck`
|
|
28
|
+
- `bun test`: 4 passed, 0 failed
|
|
29
|
+
- `bun run build`
|
|
30
|
+
- `bun run binary`
|
|
31
|
+
- `bun run binaries`: 12 native assets built and verified
|
|
32
|
+
- `mirror version plan patch`: planned `0.2.1` to `0.2.2`
|
|
33
|
+
- `xdocs meta . --documents --strict --owner runx --format json`
|
|
34
|
+
- Pull request `#4` CI: passed
|
|
35
|
+
|
|
36
|
+
## Release evidence
|
|
37
|
+
|
|
38
|
+
- Protected-main merge: `57c7d81`
|
|
39
|
+
- Mirror release commit: `6c67be5`
|
|
40
|
+
- Local annotated tag: `@guiho/runx@0.2.2`
|
|
41
|
+
- Remote tag: not created
|
|
42
|
+
- Publish workflow run: not started
|
|
43
|
+
- npm latest version after the attempt: `0.2.0`
|
|
44
|
+
|
|
45
|
+
## Blocking rules
|
|
46
|
+
|
|
47
|
+
GitHub rejected the tag with `GH013` because the active tag ruleset both
|
|
48
|
+
requires linear history and restricts tag creation. The reported merge-commit
|
|
49
|
+
violation was `f445631`. The ruleset had no bypass actors, and the authenticated
|
|
50
|
+
repository owner could not bypass it.
|
|
51
|
+
|
|
52
|
+
Trusted publishing itself was not exercised by this attempt. The tag ruleset
|
|
53
|
+
must permit the release actor to create the version tag before npm OIDC can be
|
|
54
|
+
validated.
|
|
@@ -7,6 +7,7 @@ files:
|
|
|
7
7
|
alpha-implementation-summary.md: Records the completed alpha implementation, checks, and release boundaries.
|
|
8
8
|
documents:
|
|
9
9
|
alpha-implementation-summary.md: Validation summary for the first RunX implementation.
|
|
10
|
+
npm-trusted-publishing-0.2.2.md: Validation evidence for the blocked 0.2.2 npm trusted-publishing retry.
|
|
10
11
|
tags:
|
|
11
12
|
- validation
|
|
12
13
|
keywords:
|
package/package.json
CHANGED