@plasius/gpu-demo-viewer 0.1.3 → 0.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +44 -0
- package/README.md +22 -0
- package/docs/adrs/adr-0002-hosted-oidc-package-publication.md +53 -0
- package/docs/adrs/index.md +1 -0
- package/package.json +3 -3
package/CHANGELOG.md
CHANGED
|
@@ -10,6 +10,48 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
|
|
|
10
10
|
- (placeholder)
|
|
11
11
|
|
|
12
12
|
- **Changed**
|
|
13
|
+
- Routed trusted validation through the organization-owned quarantined
|
|
14
|
+
self-hosted runner group while continuing to reject fork pull-request code.
|
|
15
|
+
- (placeholder)
|
|
16
|
+
|
|
17
|
+
- **Fixed**
|
|
18
|
+
- (placeholder)
|
|
19
|
+
|
|
20
|
+
- **Security**
|
|
21
|
+
- (placeholder)
|
|
22
|
+
|
|
23
|
+
## [0.1.5] - 2026-08-31
|
|
24
|
+
|
|
25
|
+
- **Added**
|
|
26
|
+
- (placeholder)
|
|
27
|
+
|
|
28
|
+
- **Changed**
|
|
29
|
+
- Restored exact-main npm publication on a GitHub-hosted runner through
|
|
30
|
+
short-lived OIDC, with an enforced Node/npm runtime and no long-lived
|
|
31
|
+
write-token fallback.
|
|
32
|
+
- Routed pull-request validation to isolated GitHub-hosted capacity while
|
|
33
|
+
retaining exact-main push validation on fixed self-hosted Linux runners.
|
|
34
|
+
- Refreshed GPU runtime dependencies to the currently published renderer,
|
|
35
|
+
shared-contract, and XR package versions so clean release installs remain
|
|
36
|
+
reproducible.
|
|
37
|
+
- Made cross-repository manifest validation compare against a committed GPU
|
|
38
|
+
demo target inventory in canonical checkouts, worktrees, and hosted CI.
|
|
39
|
+
- (placeholder)
|
|
40
|
+
|
|
41
|
+
- **Fixed**
|
|
42
|
+
- Peeled existing annotated release tags to their target commits before
|
|
43
|
+
exact-main recovery comparisons.
|
|
44
|
+
|
|
45
|
+
- **Security**
|
|
46
|
+
- (placeholder)
|
|
47
|
+
|
|
48
|
+
## [0.1.4] - 2026-08-30
|
|
49
|
+
|
|
50
|
+
- **Added**
|
|
51
|
+
- (placeholder)
|
|
52
|
+
|
|
53
|
+
- **Changed**
|
|
54
|
+
- Refreshed the browser demo runtime dependencies and package lockfile.
|
|
13
55
|
- (placeholder)
|
|
14
56
|
|
|
15
57
|
- **Fixed**
|
|
@@ -121,3 +163,5 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
|
|
|
121
163
|
[0.1.1]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.1.1
|
|
122
164
|
[0.1.2]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.1.2
|
|
123
165
|
[0.1.3]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.1.3
|
|
166
|
+
[0.1.4]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.1.4
|
|
167
|
+
[0.1.5]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.1.5
|
package/README.md
CHANGED
|
@@ -1,5 +1,12 @@
|
|
|
1
1
|
# @plasius/gpu-demo-viewer
|
|
2
2
|
|
|
3
|
+
[](https://www.npmjs.com/package/@plasius/gpu-demo-viewer)
|
|
4
|
+
[](https://github.com/Plasius-LTD/gpu-demo-viewer/actions/workflows/ci.yml)
|
|
5
|
+
[](./LICENSE)
|
|
6
|
+
[](./CODE_OF_CONDUCT.md)
|
|
7
|
+
[](./SECURITY.md)
|
|
8
|
+
[](./CHANGELOG.md)
|
|
9
|
+
|
|
3
10
|
Static root-level launcher for validating the `gpu-*` package demos from one place.
|
|
4
11
|
|
|
5
12
|
## Purpose
|
|
@@ -126,3 +133,18 @@ npm test
|
|
|
126
133
|
- Delivery workflow: [`WORKFLOW.md`](./WORKFLOW.md)
|
|
127
134
|
- Feature flags and capabilities: [`FLAGS_AND_CAPABILITIES.md`](./FLAGS_AND_CAPABILITIES.md)
|
|
128
135
|
- Architectural decision log: [`docs/adrs/index.md`](./docs/adrs/index.md)
|
|
136
|
+
<!-- BEGIN PLASIUS RELEASE INTEGRITY -->
|
|
137
|
+
## Release integrity
|
|
138
|
+
|
|
139
|
+
Production package publication runs only from `.github/workflows/cd.yml` on
|
|
140
|
+
protected `main`. The job verifies that the prepared commit is still the
|
|
141
|
+
current main commit and has an exact successful `ci.yml` push result before it
|
|
142
|
+
mutates release state. Same-repository pull requests and exact-main pushes use
|
|
143
|
+
the organization-owned `Public CI - Quarantined` runner group with fixed
|
|
144
|
+
self-hosted Linux labels; fork code is not admitted to that trusted runner
|
|
145
|
+
boundary. npm publication runs on
|
|
146
|
+
GitHub-hosted Node.js 24 with
|
|
147
|
+
npm 11.5.1 or newer, uses the protected `production` environment and
|
|
148
|
+
short-lived npm OIDC with provenance, and has no long-lived npm write-token
|
|
149
|
+
fallback. Rollback disables CD; it never rewrites published package history.
|
|
150
|
+
<!-- END PLASIUS RELEASE INTEGRITY -->
|
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
# ADR-0002: Hosted OIDC package publication
|
|
2
|
+
|
|
3
|
+
- Status: Accepted
|
|
4
|
+
- Date: 2026-08-09
|
|
5
|
+
|
|
6
|
+
## Context
|
|
7
|
+
|
|
8
|
+
npm trusted publishing accepts GitHub Actions only from GitHub-hosted runners.
|
|
9
|
+
The previous `gpu-demo-viewer` release job selected self-hosted infrastructure and
|
|
10
|
+
required a long-lived npm write token. That prevented the package from using
|
|
11
|
+
its configured trusted-publisher binding and left release availability coupled
|
|
12
|
+
to a reusable credential.
|
|
13
|
+
|
|
14
|
+
The parent rollout control is
|
|
15
|
+
`platform.public-artifact-integrity.enabled`. It governs staged release
|
|
16
|
+
restoration but cannot bypass source, CI, package, or publication integrity
|
|
17
|
+
checks. No product capability is introduced.
|
|
18
|
+
|
|
19
|
+
## Decision
|
|
20
|
+
|
|
21
|
+
Publication is phase-isolated: dependency installation, package validation, SBOM generation, and immutable tarball packing run in `validate_and_pack` without the `production` environment or OIDC permission. The final hosted `publish` job downloads only that sealed artifact, explicitly installs npm 11.6.2, runs no repository dependency code, and publishes the tarball with lifecycle scripts disabled. It re-fetches current `main` immediately before the first release mutation and again immediately before npm publication. `.npmrc` contains no registry-auth placeholder, and release preparation returns the reviewed current `main` HEAD rather than package-file history.
|
|
22
|
+
|
|
23
|
+
The final npm publication job in `.github/workflows/cd.yml`:
|
|
24
|
+
|
|
25
|
+
1. runs on the literal `ubuntu-latest` GitHub-hosted runner;
|
|
26
|
+
2. remains bound to protected `main` and the GitHub `production`
|
|
27
|
+
environment;
|
|
28
|
+
3. verifies that the prepared commit still equals remote `main` and that an
|
|
29
|
+
exact-SHA `ci.yml` push run completed successfully;
|
|
30
|
+
4. verifies Node.js 24 and npm 11.5.1 or newer before publication;
|
|
31
|
+
5. receives least-privilege `id-token: write` and publishes only through npm
|
|
32
|
+
OIDC with provenance; and
|
|
33
|
+
6. has no `NPM_TOKEN`, `NODE_AUTH_TOKEN`, or long-lived write-token
|
|
34
|
+
fallback.
|
|
35
|
+
|
|
36
|
+
The external npm trusted publisher is bound exactly to organization
|
|
37
|
+
`Plasius-LTD`, repository `gpu-demo-viewer`, workflow `cd.yml`, environment
|
|
38
|
+
`production`, and action `npm publish`.
|
|
39
|
+
|
|
40
|
+
## Consequences
|
|
41
|
+
|
|
42
|
+
- A moved main branch, absent exact-SHA CI result, unsupported runtime, missing
|
|
43
|
+
trusted-publisher binding, or OIDC failure stops publication before npm
|
|
44
|
+
mutation.
|
|
45
|
+
- Same-repository pull-request and exact-main push validation use the
|
|
46
|
+
organization-owned `Public CI - Quarantined` runner group with fixed
|
|
47
|
+
self-hosted Linux labels and no caller-controlled runner selection. Fork code
|
|
48
|
+
is rejected before that boundary. The narrow npm publication boundary remains
|
|
49
|
+
hosted.
|
|
50
|
+
- Releases use short-lived workflow identity and retain npm provenance without
|
|
51
|
+
a reusable write credential.
|
|
52
|
+
- Rollback disables `cd.yml` or the release-integrity flag. Published package
|
|
53
|
+
history, tags, and registry versions are never rewritten or deleted.
|
package/docs/adrs/index.md
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@plasius/gpu-demo-viewer",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.5",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "Root validation viewer for Plasius gpu-* demos.",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -49,7 +49,7 @@
|
|
|
49
49
|
"test": "node --test"
|
|
50
50
|
},
|
|
51
51
|
"dependencies": {
|
|
52
|
-
"@plasius/gpu-renderer": "^0.2.
|
|
53
|
-
"@plasius/gpu-shared": "^1.
|
|
52
|
+
"@plasius/gpu-renderer": "^0.2.43",
|
|
53
|
+
"@plasius/gpu-shared": "^1.1.1"
|
|
54
54
|
}
|
|
55
55
|
}
|