@markstanden/opencode-test-container 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/release-0.1.0.md +52 -0
- package/docs/releasing.md +82 -0
- package/package.json +1 -1
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
# Release 0.1.0
|
|
2
|
+
|
|
3
|
+
Published 2026-11-15. This is the first public release of
|
|
4
|
+
`@markstanden/opencode-test-container`.
|
|
5
|
+
|
|
6
|
+
## Source provenance
|
|
7
|
+
|
|
8
|
+
| Fact | Value |
|
|
9
|
+
| ------------------ | ------------------------------------------------------------------- |
|
|
10
|
+
| Pull request | [#1](https://github.com/markstanden/opencode-test-container/pull/1) |
|
|
11
|
+
| Merged head | `287e30a236e34b0dda8a24d966d7c3d6140d0c1b` |
|
|
12
|
+
| Merge commit | `f56092f514c2f3c5055042582adf336090630757` |
|
|
13
|
+
| Registry `gitHead` | `f56092f514c2f3c5055042582adf336090630757` |
|
|
14
|
+
| Merge method | squash |
|
|
15
|
+
| Merge gate | Defined Gate green on the merged head and on `main` after merge |
|
|
16
|
+
|
|
17
|
+
The release was built from the clean merged `main` at the merge commit above.
|
|
18
|
+
`npm ci` and `defined comply` passed before packing.
|
|
19
|
+
|
|
20
|
+
## Artifact identity
|
|
21
|
+
|
|
22
|
+
| Fact | Value |
|
|
23
|
+
| --------------------- | ----------------------------------------------------------------------------------------------------- |
|
|
24
|
+
| Package | `@markstanden/opencode-test-container` |
|
|
25
|
+
| Version | `0.1.0` |
|
|
26
|
+
| Tarball | `markstanden-opencode-test-container-0.1.0.tgz` |
|
|
27
|
+
| Local tarball SHA-256 | `a3731bb52bc154173bb6103a2e175b5a9fc19b3b8ca9bf90e2e07fb12495015b` |
|
|
28
|
+
| Registry shasum | `c336020f78aa49953964692020a9be2497c19885` |
|
|
29
|
+
| Registry integrity | `sha512-5dhOJwj4UgxLnOdLoW/gMeLnJ2lU0A8aDj2h5cIwo/iV5hULvrLogE6Ihjom07TzenE/ZOJZ6WPfzqx3iulXZg==` |
|
|
30
|
+
| Registry tarball | <https://registry.npmjs.org/@markstanden/opencode-test-container/-/opencode-test-container-0.1.0.tgz> |
|
|
31
|
+
| Files / unpacked size | 121 / 942,231 bytes |
|
|
32
|
+
| Published | `2026-11-15T14:13:49.115Z` |
|
|
33
|
+
|
|
34
|
+
The local tarball and registry artefact carry the same shasum and integrity;
|
|
35
|
+
the registry reports the merge commit as `gitHead`.
|
|
36
|
+
|
|
37
|
+
## Verification
|
|
38
|
+
|
|
39
|
+
- Covered by `defined comply` at the merge commit: typecheck, ordinary tests,
|
|
40
|
+
coverage floors and the packaged-CLI proof.
|
|
41
|
+
- Registry signatures are present for the npm signing key
|
|
42
|
+
`SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U`.
|
|
43
|
+
- No npm provenance attestation was generated: publication was a local
|
|
44
|
+
`npm publish`, not a supported CI OIDC publish. The merge commit, tarball
|
|
45
|
+
SHA-256, registry integrity and registry signatures above are the available
|
|
46
|
+
provenance evidence.
|
|
47
|
+
|
|
48
|
+
## Notes
|
|
49
|
+
|
|
50
|
+
- `0.1.0` is the `latest` dist-tag.
|
|
51
|
+
- The registry also lists an earlier `0.0.0-stage` version; it is not this
|
|
52
|
+
release and carries no OTC support claim.
|
|
@@ -0,0 +1,82 @@
|
|
|
1
|
+
# Releasing
|
|
2
|
+
|
|
3
|
+
Publication runs from `.github/workflows/npm--publish.yml` using npm trusted
|
|
4
|
+
publishing (GitHub OIDC). A release tag is the publish switch: there is no
|
|
5
|
+
local `npm publish` step and no `NPM_TOKEN`.
|
|
6
|
+
|
|
7
|
+
## One-time npm setup
|
|
8
|
+
|
|
9
|
+
Configure the package's trusted publisher on npmjs.com (package Settings →
|
|
10
|
+
Trusted Publisher → GitHub Actions). The provider and required fields cannot be
|
|
11
|
+
edited later; a mistake means deleting the connection and creating another.
|
|
12
|
+
|
|
13
|
+
| Field | Value |
|
|
14
|
+
| ----------------- | ------------------------- |
|
|
15
|
+
| Organization/user | `markstanden` |
|
|
16
|
+
| Repository | `opencode-test-container` |
|
|
17
|
+
| Workflow filename | `npm--publish.yml` |
|
|
18
|
+
| Environment name | `npm-publish` |
|
|
19
|
+
|
|
20
|
+
Two settings decide whether the first release works at all:
|
|
21
|
+
|
|
22
|
+
- **Allowed actions must include `npm publish`.** The browser form offers
|
|
23
|
+
`npm publish`, `npm stage publish` and `npm dist-tag`, with at least one
|
|
24
|
+
required. The workflow runs plain `npm publish`, so tick that box; dist-tag
|
|
25
|
+
is not needed.
|
|
26
|
+
- **`package.json` `repository.url` must match the GitHub repository.** If it
|
|
27
|
+
does not, npm refuses the OIDC publish.
|
|
28
|
+
|
|
29
|
+
The connection expires if it is not validated: create it immediately before
|
|
30
|
+
the release tag, not weeks ahead, and finish the first publish within two days.
|
|
31
|
+
|
|
32
|
+
Also configure:
|
|
33
|
+
|
|
34
|
+
- Repository settings → Environments → `npm-publish`, with required reviewers
|
|
35
|
+
if the release should wait for a human. The environment name here and in the
|
|
36
|
+
npm form must be identical; a mismatch fails at publish time, not on save.
|
|
37
|
+
- Package Settings → Publishing access → _Require two-factor authentication and
|
|
38
|
+
disallow bypass 2FA tokens_, once a release has published over OIDC. Trusted
|
|
39
|
+
publishers keep working; token-based publishing stops.
|
|
40
|
+
|
|
41
|
+
## Release steps
|
|
42
|
+
|
|
43
|
+
1. Bump `version` in `package.json` and in `package-lock.json` (both the
|
|
44
|
+
top-level and `packages[""]` entries), merge to `main`, and let the Defined
|
|
45
|
+
Gate go green.
|
|
46
|
+
2. Tag the merge commit — not the branch head you happen to have:
|
|
47
|
+
|
|
48
|
+
```sh
|
|
49
|
+
git tag -a v0.1.1 -m "0.1.1" <merge-commit>
|
|
50
|
+
git push origin v0.1.1 # this is the publish
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
3. Approve the `npm-publish` environment deployment in the run.
|
|
54
|
+
4. Verify the artefact (below).
|
|
55
|
+
|
|
56
|
+
`workflow_dispatch` re-runs the same job against a tag chosen in the ref
|
|
57
|
+
selector; it refuses a branch ref.
|
|
58
|
+
|
|
59
|
+
## What the workflow refuses
|
|
60
|
+
|
|
61
|
+
- Any ref that is not a `v*` tag.
|
|
62
|
+
- A tag that is not `v<package.json version>`.
|
|
63
|
+
- A tag whose commit is not an ancestor of `main`, so only gated, merged
|
|
64
|
+
commits ship.
|
|
65
|
+
- A tree that fails `defined verify` in the pinned gate image. `comply` is
|
|
66
|
+
deliberately not used: it repairs files, and the tarball must be the tagged
|
|
67
|
+
source.
|
|
68
|
+
|
|
69
|
+
`npm publish` builds `dist` through `prepack`, and npm generates the provenance
|
|
70
|
+
attestation automatically under OIDC on a public repository.
|
|
71
|
+
|
|
72
|
+
## Verifying a release
|
|
73
|
+
|
|
74
|
+
```sh
|
|
75
|
+
npm audit signatures
|
|
76
|
+
npm view @markstanden/opencode-test-container@0.1.1 dist.attestations
|
|
77
|
+
npm view @markstanden/opencode-test-container@0.1.1 gitHead
|
|
78
|
+
```
|
|
79
|
+
|
|
80
|
+
The attestation ties the tarball to this repository, workflow, tag and commit.
|
|
81
|
+
`0.1.0` predates trusted publishing and carries no attestation; see
|
|
82
|
+
[release-0.1.0.md](release-0.1.0.md).
|