@releaseway/npm-actions-fixture 0.0.8-native.0 → 0.0.10-native.0

package/.releaseway/native.json

@@ -1,7 +1,7 @@
 {
   "repository": "releaseway/npm-actions-fixture",
-  "version": "0.0.8-native.0",
-  "tag": "native-v0.0.8-native.0",
+  "version": "0.0.10-native.0",
+  "tag": "native-v0.0.10-native.0",
   "targets": {
     "linux-x64-gnu": {
       "asset": "npm-actions-native-fixture_linux_x64.tar.gz",

package/.releaseway/runtime.cjs

@@ -1387,7 +1387,7 @@ __export(runtime_exports, {
 });
 module.exports = __toCommonJS(runtime_exports);
 var import_node_child_process2 = require("node:child_process");
-var import_node_process3 = __toESM(require("node:process"));
+var import_node_process3 = __toESM(require("node:process"), 1);
 
 // src/native/launcher/cache.ts
 var import_node_crypto3 = require("node:crypto");
@@ -1395,7 +1395,7 @@ var import_node_fs8 = require("node:fs");
 var import_promises3 = require("node:fs/promises");
 var import_node_os = require("node:os");
 var import_node_path11 = require("node:path");
-var import_node_process = __toESM(require("node:process"));
+var import_node_process = __toESM(require("node:process"), 1);
 
 // src/native/limits.ts
 function nativeLimits(env = process.env) {
@@ -4450,7 +4450,7 @@ var To = (s3) => {
 };
 
 // src/native/launcher/archive.ts
-var import_yauzl = __toESM(require_yauzl());
+var import_yauzl = __toESM(require_yauzl(), 1);
 function normalizeArchivePath(value) {
   if (value.length === 0 || value.includes("\0") || value.includes("\\") || value.startsWith("/") || /^[A-Za-z]:/.test(value)) {
     throw new Error(`Unsafe archive entry path: ${value}`);
@@ -5159,7 +5159,7 @@ async function loadNativeManifest(manifestPath) {
 
 // src/native/launcher/target.ts
 var import_node_child_process = require("node:child_process");
-var import_node_process2 = __toESM(require("node:process"));
+var import_node_process2 = __toESM(require("node:process"), 1);
 function linuxLibcFromReport(report) {
   if (!report || typeof report !== "object" || Array.isArray(report)) {
     return void 0;

package/README.md

@@ -4,7 +4,7 @@ Permanent integration fixture for releaseway/npm-actions.
 
 This package exercises real npm registry and GitHub Release behavior: registry-first version selection, Trusted Publishing OIDC, staged submissions, and native installation and execution. It is not intended for application dependencies or production use.
 
-The committed package remains an ordinary non-native fixture. Workflows rewrite checkout-local metadata without committing it. Both accept a full `action-ref` SHA, default to the same stable reviewed commit, verify the checked-out SHA and run `./npm-action`.
+The committed package remains an ordinary non-native fixture. Fixture-specific native bin metadata and the legacy package-json version scenario are prepared locally; tag-derived scenarios preserve the source version. Publication channels are declared as stable `latest` and prerelease `next` in Releaseway policy, without rewriting `publishConfig.tag`. Both workflows accept a full `action-ref` SHA, verify the checked-out SHA and run `./npm-action`.
 
 ## Result contract
 
@@ -40,9 +40,9 @@ The defaults use `0.0.5-fixture.0` with `already-published` to exercise version
 - Workflow filename: `direct.yml`
 - Allowed action: enable `Allow npm publish`
 
-The inputs default to `fixture-version=0.0.6-native.0` and `expected-state=already-published`. For this scenario the workflow skips Release creation and source-commit comparison, invokes npm-actions to verify the version is already public, then installs and executes the published CLI. It may run from a later source commit than the original Release. It does not republish the historical package or test a newly generated runtime.
+The inputs default to `fixture-version=0.0.9-native.0` and `expected-state=already-published`. For this scenario the workflow skips Release creation and source-commit comparison, invokes npm-actions to verify the version is already public, then installs and executes the published CLI. It may run from a later source commit than the original Release. It does not republish the historical package or test a newly generated runtime.
 
-To publish a new native fixture, select a fresh `0.0.N-native.M` version and `expected-state=published`. Repository release immutability must be enabled. The workflow creates or reuses a same-commit `native-v<version>` Release, uploads the Linux x64 asset, and waits for immutability and a SHA-256 asset digest before invoking npm-actions. The action prepares only an unpublished candidate and confirms its exact SHA-512 in the live registry.
+To publish a new native fixture, select a fresh `0.0.N-native.M` version and `expected-state=published`. Repository release immutability must be enabled. Product steps build the deterministic Linux x64 asset. `releaseway/actions/prepare` binds the same-commit `native-v<version>` tag and `releaseway/actions` publishes or resumes its immutable prerelease with verified asset digests, before npm-actions publishes to `next`. The action prepares only an unpublished candidate and confirms its exact SHA-512 in the live registry.
 
 Both native scenarios install the exact version with `--ignore-scripts` on Node 22, 24 and 26, each with a separate empty native cache. They execute the CLI, make its populated cache read-only, execute again and compare file snapshots. Fresh `published` runs also compare installed package-lock SHA-512 with the action report's frozen plan. Historical lookup remains a separate result.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@releaseway/npm-actions-fixture",
-  "version": "0.0.8-native.0",
+  "version": "0.0.10-native.0",
   "description": "Integration fixture for releaseway/npm-actions. Not for production use.",
   "type": "module",
   "exports": "./index.js",
@@ -12,8 +12,7 @@
     "url": "git+https://github.com/releaseway/npm-actions-fixture.git"
   },
   "publishConfig": {
-    "access": "public",
-    "tag": "native"
+    "access": "public"
   },
   "bin": {
     "npm-actions-native-fixture": "bin/npm-actions-native-fixture"