@link-assistant/hive-mind 2.20.0 → 2.21.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +30 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,35 @@
|
|
|
1
1
|
# @link-assistant/hive-mind
|
|
2
2
|
|
|
3
|
+
## 2.21.1
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- f19f9f7: CI/CD guide, principle 10: a serialised writer still checks out `github.sha`
|
|
8
|
+
|
|
9
|
+
The concurrency group orders main-writing jobs; it does not refresh their
|
|
10
|
+
working trees, so the second writer in the queue starts behind the branch and
|
|
11
|
+
its push is rejected as non-fast-forward. Principle 10 now says so, rules out
|
|
12
|
+
`ref: main` on the checkout (it publishes a tree CI never validated), and
|
|
13
|
+
prescribes the recovery: classify the rejection — a GH006/GH013 ruleset
|
|
14
|
+
rejection prints `rejected` too and can never be satisfied by a rebase — then
|
|
15
|
+
rebase and retry. Added to all four translations, with the pull-request
|
|
16
|
+
recovery cross-referenced from principle 9.
|
|
17
|
+
|
|
18
|
+
## 2.21.0
|
|
19
|
+
|
|
20
|
+
### Minor Changes
|
|
21
|
+
|
|
22
|
+
- 72d5911: Prove the release can be published before building it: a `release-preflight` job now gates every publishing job, and the guide gains principle #16 (issue #2221).
|
|
23
|
+
|
|
24
|
+
A pull request exists to test the code; a push to `main` exists to produce a release. `release.yml` did not distinguish them: `DOCKERHUB_TOKEN` was first touched by a `docker/login-action` step that runs _after_ npm has already published, so an expired token was discovered at the end of a run whose entire purpose was the release. link-foundation/box#117 is the worked example — run 33972074755 built the whole image matrix, published 2.5.0 and 2.6.0, reported `success`, and delivered no images at all, because the login step was `continue-on-error: true`, the mirror steps were guarded on its outcome, and `skipped` is not `failure`.
|
|
25
|
+
|
|
26
|
+
- **The probe attempts a write, because a login proves nothing.** Measured against both registries and recorded in `dev/log/issues/2221/live-probe.log`: docker.io answers an _anonymous_ `pull,push` token request with HTTP 200 and silently narrows the `access` claim to `pull`, so a check that reads 200 as "I can push" passes with no credentials at all; with a credential ghcr.io answers 200 too and hands back the credential base64-encoded. `scripts/registry-probe.lib.mjs` instead opens a blob upload session (`POST /v2/<repo>/blobs/uploads/`) and cancels it with `DELETE <Location>` — one round trip, nothing stored, no blob, no manifest, no tag, no package version.
|
|
27
|
+
- **Every credential is reported, not just the first.** `scripts/preflight-credentials.mjs` probes all targets and decides the exit code at the end, so a broken pipeline is fixed in one pass rather than one credential per run. On `pull_request` it runs in `report` mode and never blocks: fork PRs have no secrets, and failing there would only block contributors. On a push to `main` or a manual dispatch it fails fast, before the build spends anything.
|
|
28
|
+
- **`unknown` is never reported as broken, and "no failures" is never reported as a pass.** A registry that times out or answers HTTP 429 has not said the credential is bad, so refusing to release on that basis would invent a new way for a release to fail; a run in which nothing could be verified says so out loud in its job summary.
|
|
29
|
+
- **Reachability is checked too, and never gates the release.** The preflight asks, with no credentials, what an anonymous consumer gets for the published images — the check that would have contradicted box's release notes, which claimed 28 of 56 image references resolved when anonymously it was 0 of 56.
|
|
30
|
+
|
|
31
|
+
`tests/release-preflight-2221.test.mjs` (22 assertions) drives the probes and the decision against a fake registry — including the two cases that make the cheap version of this check useless — and runs the real CLI end to end for both exit codes; `tests/cicd-best-practices-publish-preflight-2221.test.mjs` pins principle #16 in all four translations of `docs/CI-CD-BEST-PRACTICES.md` and asserts this repository follows it. `experiments/issue-2221-registry-probe-live.mjs` reproduces the live measurement.
|
|
32
|
+
|
|
3
33
|
## 2.20.0
|
|
4
34
|
|
|
5
35
|
### Minor Changes
|