@plasius/game-audio-react 0.1.3 → 0.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +25 -0
- package/README.md +14 -1
- package/docs/adrs/adr-0002-hosted-oidc-package-publication.md +51 -0
- package/docs/adrs/index.md +1 -0
- package/package.json +5 -1
package/CHANGELOG.md
CHANGED
|
@@ -18,6 +18,30 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
|
18
18
|
- **Security**
|
|
19
19
|
- (placeholder)
|
|
20
20
|
|
|
21
|
+
## [0.1.4] - 2026-09-13
|
|
22
|
+
|
|
23
|
+
### Changed
|
|
24
|
+
- Refresh compatible npm dependencies from the registry for the weekly dependency maintenance wave.
|
|
25
|
+
|
|
26
|
+
|
|
27
|
+
- **Added**
|
|
28
|
+
- (placeholder)
|
|
29
|
+
|
|
30
|
+
- **Changed**
|
|
31
|
+
- Restored exact-main npm publication on a GitHub-hosted runner through
|
|
32
|
+
short-lived OIDC, with an enforced Node/npm runtime and no long-lived
|
|
33
|
+
write-token fallback.
|
|
34
|
+
- Moved public package CI to GitHub-hosted capacity so internal and external
|
|
35
|
+
branches cannot queue on or execute against company-managed runners.
|
|
36
|
+
- (placeholder)
|
|
37
|
+
|
|
38
|
+
- **Fixed**
|
|
39
|
+
- (placeholder)
|
|
40
|
+
|
|
41
|
+
- **Security**
|
|
42
|
+
- Pinned patched transitive npm dependencies to clear the current audit baseline.
|
|
43
|
+
- (placeholder)
|
|
44
|
+
|
|
21
45
|
## [0.1.3] - 2026-06-22
|
|
22
46
|
|
|
23
47
|
- **Added**
|
|
@@ -43,3 +67,4 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
|
43
67
|
|
|
44
68
|
[0.1.2]: https://github.com/Plasius-LTD/game-audio-react/releases/tag/v0.1.2
|
|
45
69
|
[0.1.3]: https://github.com/Plasius-LTD/game-audio-react/releases/tag/v0.1.3
|
|
70
|
+
[0.1.4]: https://github.com/Plasius-LTD/game-audio-react/releases/tag/v0.1.4
|
package/README.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# @plasius/game-audio-react
|
|
2
2
|
|
|
3
|
-
[](https://www.npmjs.com/package/@plasius/game-audio-react)
|
|
4
4
|
[](https://github.com/Plasius-LTD/game-audio-react/actions/workflows/ci.yml)
|
|
5
5
|
[](https://codecov.io/gh/Plasius-LTD/game-audio-react)
|
|
6
6
|
[](./LICENSE)
|
|
@@ -68,3 +68,16 @@ npm run pack:check
|
|
|
68
68
|
## License
|
|
69
69
|
|
|
70
70
|
Apache-2.0
|
|
71
|
+
<!-- BEGIN PLASIUS RELEASE INTEGRITY -->
|
|
72
|
+
## Release integrity
|
|
73
|
+
|
|
74
|
+
Production package publication runs only from `.github/workflows/cd.yml` on
|
|
75
|
+
protected `main`. The job verifies that the prepared commit is still the
|
|
76
|
+
current main commit and has an exact successful `ci.yml` push result before it
|
|
77
|
+
mutates release state. Public package CI runs on GitHub-hosted capacity so it
|
|
78
|
+
cannot execute on company-managed runners. npm publication runs on
|
|
79
|
+
GitHub-hosted Node.js 24 with
|
|
80
|
+
npm 11.5.1 or newer, uses the protected `production` environment and
|
|
81
|
+
short-lived npm OIDC with provenance, and has no long-lived npm write-token
|
|
82
|
+
fallback. Rollback disables CD; it never rewrites published package history.
|
|
83
|
+
<!-- END PLASIUS RELEASE INTEGRITY -->
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
# ADR-0002: Hosted OIDC package publication
|
|
2
|
+
|
|
3
|
+
- Status: Accepted
|
|
4
|
+
- Date: 2026-08-09
|
|
5
|
+
|
|
6
|
+
## Context
|
|
7
|
+
|
|
8
|
+
npm trusted publishing accepts GitHub Actions only from GitHub-hosted runners.
|
|
9
|
+
The previous `game-audio-react` release job selected self-hosted infrastructure and
|
|
10
|
+
required a long-lived npm write token. That prevented the package from using
|
|
11
|
+
its configured trusted-publisher binding and left release availability coupled
|
|
12
|
+
to a reusable credential.
|
|
13
|
+
|
|
14
|
+
The parent rollout control is
|
|
15
|
+
`platform.public-artifact-integrity.enabled`. It governs staged release
|
|
16
|
+
restoration but cannot bypass source, CI, package, or publication integrity
|
|
17
|
+
checks. No product capability is introduced.
|
|
18
|
+
|
|
19
|
+
## Decision
|
|
20
|
+
|
|
21
|
+
Publication is phase-isolated: dependency installation, package validation, SBOM generation, and immutable tarball packing run in `validate_and_pack` without the `production` environment or OIDC permission. The final hosted `publish` job downloads only that sealed artifact, explicitly installs npm 11.6.2, runs no repository dependency code, and publishes the tarball with lifecycle scripts disabled. It re-fetches current `main` immediately before the first release mutation and again immediately before npm publication. `.npmrc` contains no registry-auth placeholder, and release preparation returns the reviewed current `main` HEAD rather than package-file history.
|
|
22
|
+
|
|
23
|
+
The final npm publication job in `.github/workflows/cd.yml`:
|
|
24
|
+
|
|
25
|
+
1. runs on the literal `ubuntu-latest` GitHub-hosted runner;
|
|
26
|
+
2. remains bound to protected `main` and the GitHub `production`
|
|
27
|
+
environment;
|
|
28
|
+
3. verifies that the prepared commit still equals remote `main` and that an
|
|
29
|
+
exact-SHA `ci.yml` push run completed successfully;
|
|
30
|
+
4. verifies Node.js 24 and npm 11.5.1 or newer before publication;
|
|
31
|
+
5. receives least-privilege `id-token: write` and publishes only through npm
|
|
32
|
+
OIDC with provenance; and
|
|
33
|
+
6. has no `NPM_TOKEN`, `NODE_AUTH_TOKEN`, or long-lived write-token
|
|
34
|
+
fallback.
|
|
35
|
+
|
|
36
|
+
The external npm trusted publisher is bound exactly to organization
|
|
37
|
+
`Plasius-LTD`, repository `game-audio-react`, workflow `cd.yml`, environment
|
|
38
|
+
`production`, and action `npm publish`.
|
|
39
|
+
|
|
40
|
+
## Consequences
|
|
41
|
+
|
|
42
|
+
- A moved main branch, absent exact-SHA CI result, unsupported runtime, missing
|
|
43
|
+
trusted-publisher binding, or OIDC failure stops publication before npm
|
|
44
|
+
mutation.
|
|
45
|
+
- Public package CI and the narrow publication boundary use isolated
|
|
46
|
+
GitHub-hosted capacity, keeping untrusted repository code away from company
|
|
47
|
+
runners and avoiding private runner-group availability drift.
|
|
48
|
+
- Releases use short-lived workflow identity and retain npm provenance without
|
|
49
|
+
a reusable write credential.
|
|
50
|
+
- Rollback disables `cd.yml` or the release-integrity flag. Published package
|
|
51
|
+
history, tags, and registry versions are never rewritten or deleted.
|
package/docs/adrs/index.md
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@plasius/game-audio-react",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.4",
|
|
4
4
|
"description": "React integration scaffold for Plasius game audio runtime packages.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"sideEffects": false,
|
|
@@ -89,6 +89,10 @@
|
|
|
89
89
|
}
|
|
90
90
|
],
|
|
91
91
|
"overrides": {
|
|
92
|
+
"esbuild": "^0.28.1",
|
|
93
|
+
"brace-expansion": "5.0.9",
|
|
94
|
+
"nanoid": "3.3.18",
|
|
95
|
+
"postcss": "8.5.26",
|
|
92
96
|
"minimatch": "^10.2.1"
|
|
93
97
|
},
|
|
94
98
|
"engines": {
|