@indigoai-us/hq-cloud 6.14.48 → 6.14.49-rc.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,3 +1,11 @@
1
+ # Releasing hq-cloud is one command:
2
+ #
3
+ # git push origin v6.15.0
4
+ #
5
+ # The tag is the source of truth for the version. This workflow stamps
6
+ # package.json from it, publishes to npm, and then pushes a `chore(release)`
7
+ # commit back to main. There is no release pull request and no version field to
8
+ # edit by hand.
1
9
  name: Publish to npm
2
10
  on:
3
11
  push:
@@ -18,10 +26,13 @@ on:
18
26
  jobs:
19
27
  publish:
20
28
  permissions:
21
- contents: read
29
+ # `contents: write` lets the release sync the version commit back to main.
30
+ contents: write
22
31
  id-token: write
23
32
  uses: indigoai-us/.github/.github/workflows/_npm-publish.yml@main
24
33
  with:
34
+ version-from-tag: true
35
+ sync-back-branch: main
25
36
  package-manager: pnpm
26
37
  # Corepack (Node-bundled) pnpm — no third-party action fetch, resilient to
27
38
  # GitHub partial-storage outages. The npm CLI still drives the OIDC publish.
@@ -31,4 +42,15 @@ jobs:
31
42
  build-command: "pnpm run build"
32
43
  # On workflow_dispatch, honor the input tag; on tag push it is empty.
33
44
  checkout-ref: ${{ inputs.tag || github.ref }}
45
+ # Prerelease versions (e.g. 6.x.y-rc.0) ship to the rc dist-tag. Without
46
+ # this they would publish straight to `latest`, and every consumer that
47
+ # depends on this package — hq-cli, create-hq, the desktop app — would
48
+ # resolve a release candidate on their next install.
49
+ prerelease-dist-tag: "rc"
34
50
  dry-run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
51
+ secrets:
52
+ # main is protected by the `main_protect` ruleset. The workflow token
53
+ # cannot satisfy it, so the version commit is pushed by the hq-audit-bot
54
+ # App, which is a bypass actor on that ruleset.
55
+ app-id: ${{ secrets.HQ_AUDIT_BOT_APP_ID }}
56
+ app-private-key: ${{ secrets.HQ_AUDIT_BOT_PRIVATE_KEY }}
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@indigoai-us/hq-cloud",
3
- "version": "6.14.48",
4
- "description": "HQ by Indigo cloud sync engine \u2014 bidirectional S3 sync for mobile access",
3
+ "version": "6.14.49-rc.0",
4
+ "description": "HQ by Indigo cloud sync engine bidirectional S3 sync for mobile access",
5
5
  "main": "dist/index.js",
6
6
  "types": "dist/index.d.ts",
7
7
  "bin": {