dsh-review-graph 1.0.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CONTRIBUTING.md +20 -3
- package/README.en.md +7 -7
- package/README.md +7 -7
- package/package.json +1 -1
package/CONTRIBUTING.md
CHANGED
|
@@ -41,15 +41,32 @@ package does:
|
|
|
41
41
|
npm publish --otp=<code from the authenticator>
|
|
42
42
|
```
|
|
43
43
|
|
|
44
|
-
After that, configure **Trusted publishing** on the package's settings page
|
|
45
|
-
`huaxiaolong/dsh-review-graph`, workflow `publish.yml
|
|
46
|
-
rest
|
|
44
|
+
After that, configure **Trusted publishing** on the package's settings page — publisher *GitHub Actions*,
|
|
45
|
+
repository `huaxiaolong/dsh-review-graph`, workflow file name `publish.yml`, environment name left empty —
|
|
46
|
+
and let `.github/workflows/publish.yml` do the rest. It needs no stored secret and publishes with
|
|
47
|
+
provenance. Two details decide whether it works: the workflow must ask for `id-token: write` (it does), and
|
|
48
|
+
the npm CLI must be 11.5.1 or newer — Node 20's bundled npm is older, so the workflow installs `npm@11`
|
|
49
|
+
first. Pin the major rather than using `npm@latest`: npm 12 requires Node 22.22.2 or newer, and asking for
|
|
50
|
+
it on an older runner fails the install with an engine error before the build even starts.
|
|
47
51
|
|
|
48
52
|
```bash
|
|
49
53
|
# bump version in package.json, commit, push
|
|
50
54
|
git tag v<version> && git push origin v<version>
|
|
51
55
|
```
|
|
52
56
|
|
|
57
|
+
### Release artifacts and their hashes
|
|
58
|
+
|
|
59
|
+
Publish the artifact `npm pack` produced — not a tarball assembled by hand. `npm pack` normalises file
|
|
60
|
+
mtimes and entry order, so the same sources produce the same bytes; a `tar -czf` of the same files does
|
|
61
|
+
not, and the registry's `shasum` will not match anything you can reproduce. If a GitHub release carries a
|
|
62
|
+
tarball, attach the one `npm pack` wrote, so the two channels share one hash.
|
|
63
|
+
|
|
64
|
+
Check the published one with:
|
|
65
|
+
|
|
66
|
+
```bash
|
|
67
|
+
npm view dsh-review-graph dist.shasum dist.tarball
|
|
68
|
+
```
|
|
69
|
+
|
|
53
70
|
Why OIDC rather than an `NPM_TOKEN`: npm is removing direct publish from tokens that bypass 2FA
|
|
54
71
|
(targeted for January 2027), so a stored token would stop working. Trusted publishing replaces it with a
|
|
55
72
|
short-lived credential minted per run.
|
package/README.en.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# dsh-review-graph
|
|
2
2
|
|
|
3
|
-
[中文](README.md) · English
|
|
3
|
+
[中文](README.md) · English · [](https://www.npmjs.com/package/dsh-review-graph)
|
|
4
4
|
|
|
5
5
|
**Which files call which, how far a change reaches, and where every edit actually is** — read it inside
|
|
6
6
|
the conversation instead of opening files one by one.
|
|
@@ -21,14 +21,14 @@ Three surfaces, in the conversation's middle column:
|
|
|
21
21
|
Requirements: DSH (Host and Web), and the workspace you review is a **git repository**.
|
|
22
22
|
|
|
23
23
|
```bash
|
|
24
|
-
# 1) from
|
|
25
|
-
dsh plugin --profile <profile> add
|
|
24
|
+
# 1) from npm (recommended)
|
|
25
|
+
dsh plugin --profile <profile> add dsh-review-graph
|
|
26
26
|
|
|
27
|
-
# 2) from
|
|
28
|
-
dsh plugin --profile <profile> add https://github.com/huaxiaolong/dsh-review-graph
|
|
27
|
+
# 2) from git (no account needed)
|
|
28
|
+
dsh plugin --profile <profile> add https://github.com/huaxiaolong/dsh-review-graph
|
|
29
29
|
|
|
30
|
-
# 3) from npm
|
|
31
|
-
dsh plugin --profile <profile> add dsh-review-graph
|
|
30
|
+
# 3) from the release tarball (no npm account needed; pins a version)
|
|
31
|
+
dsh plugin --profile <profile> add https://github.com/huaxiaolong/dsh-review-graph/releases/download/v1.0.0/dsh-review-graph-1.0.0.tgz
|
|
32
32
|
```
|
|
33
33
|
|
|
34
34
|
Or in the GUI: **Plugins** in the sidebar → **Add plugin** → paste any of the above (package name, git
|
package/README.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# dsh-review-graph
|
|
2
2
|
|
|
3
|
-
[English](README.en.md) · 中文
|
|
3
|
+
[English](README.en.md) · 中文 · [](https://www.npmjs.com/package/dsh-review-graph)
|
|
4
4
|
|
|
5
5
|
一次变更里**哪些文件互相调用、影响面多大、每处改动到底在哪一行**——在会话里直接看懂，不用在编辑器里一个个翻。
|
|
6
6
|
|
|
@@ -20,14 +20,14 @@
|
|
|
20
20
|
要求：DSH（Host + Web 端），被审查的工作区是 **git 仓库**。
|
|
21
21
|
|
|
22
22
|
```bash
|
|
23
|
-
# 1) 从
|
|
24
|
-
dsh plugin --profile <profile> add
|
|
23
|
+
# 1) 从 npm（推荐）
|
|
24
|
+
dsh plugin --profile <profile> add dsh-review-graph
|
|
25
25
|
|
|
26
|
-
# 2) 从
|
|
27
|
-
dsh plugin --profile <profile> add https://github.com/huaxiaolong/dsh-review-graph
|
|
26
|
+
# 2) 从 git（无需任何账号）
|
|
27
|
+
dsh plugin --profile <profile> add https://github.com/huaxiaolong/dsh-review-graph
|
|
28
28
|
|
|
29
|
-
# 3) 从 npm
|
|
30
|
-
dsh plugin --profile <profile> add dsh-review-graph
|
|
29
|
+
# 3) 从 Release 里的 tarball（无需 npm 账号，可钉死版本）
|
|
30
|
+
dsh plugin --profile <profile> add https://github.com/huaxiaolong/dsh-review-graph/releases/download/v1.0.0/dsh-review-graph-1.0.0.tgz
|
|
31
31
|
```
|
|
32
32
|
|
|
33
33
|
或在 GUI 里：侧栏「**插件**」→ **Add plugin** → 粘贴上面任意一种（包名、git 地址、tarball 地址或本地路径）。
|
package/package.json
CHANGED