everkm-publish 0.17.0 → 0.17.2

package/README-MAINTAINERS.md

@@ -0,0 +1,61 @@
+# Maintainers
+
+本仓库即 [`everkm/publish`](https://github.com/everkm/publish)（`everkm-publish-npm` 仅为本地/历史别名）。
+
+## Release
+
+1. **Binary Release** — tag 触发构建并发布 GitHub Release（含 notes）:
+
+   ```bash
+   git tag everkm-publish@v0.17.0
+   git push origin everkm-publish@v0.17.0
+   ```
+
+   等待构建完成，确认 Release 资产与 notes。
+
+2. **CDN + npm** — semver tag 触发 CDN 镜像与 npm publish:
+
+   ```bash
+   git tag v0.17.0
+   git push origin v0.17.0
+
+   # or via Makefile
+   make tag TAG=v0.17.0
+   ```
+
+3. Verify:
+
+   ```bash
+   curl -s https://ekmp-assets.everkm.com/pkgs/latest.json
+   npm view everkm-publish version
+   ```
+
+Manual re-run: GitHub Actions → **Publish NPM Package** → `workflow_dispatch`.
+
+## GitHub Secrets
+
+| Secret | 用途 |
+|--------|------|
+| `CF_S3_AK` / `CF_S3_SK` | Cloudflare R2 上传 |
+| `QINIU_ACCESS_KEY` / `QINIU_SECRET_KEY` | 七牛上传与 CDN 刷新 |
+| `GH_TOKEN` | 读取同仓 GitHub Release（未设置时回退 `GITHUB_TOKEN`） |
+| `NPM_TOKEN` | npm publish（见下） |
+| `NOTIFY_DAYU_ENDPOINT` | workflow 结束 Telegram 通知（可选） |
+
+### `NPM_TOKEN` 配置
+
+CI 无法输入 authenticator 验证码；若账号启用了 2FA，token **必须**支持自动化发布，否则 `npm publish` 会报 `EOTP`。
+
+在 [npmjs.com](https://www.npmjs.com) → **Access Tokens** 创建 **Granular Access Token**（或 Classic **Automation** token）：
+
+1. **Packages and scopes**：对 `everkm-publish` 授予 **Read and write**（或 all packages）
+2. **Security settings**：勾选 **Bypass two-factor authentication (2FA)**
+3. 若包归属 npm organization，还需在 **Organizations** 中授权对应 org
+
+将 token 写入仓库 **Settings → Secrets → Actions → `NPM_TOKEN`**。更新后重新跑 workflow 即可。
+
+本地验证 token：
+
+```bash
+npm whoami --registry=https://registry.npmjs.org/ --//registry.npmjs.org/:_authToken=YOUR_TOKEN
+```

package/README.md

@@ -14,36 +14,6 @@ pnpm add everkm-publish
 
 `postinstall` downloads the platform binary from CDN (`.com` → GitHub → `.cn`), with a 5s timeout per source.
 
-## Release (maintainers)
+---
 
-本仓库即 [`everkm/publish`](https://github.com/everkm/publish)（`everkm-publish-npm` 仅为本地/历史别名）。
-
-1. **Binary Release** — tag 触发构建并发布 GitHub Release（含 notes）:
-
-   ```bash
-   git tag everkm-publish@v0.17.0
-   git push origin everkm-publish@v0.17.0
-   ```
-
-   等待构建完成，确认 Release 资产与 notes。
-
-2. **CDN + npm** — semver tag 触发 CDN 镜像与 npm publish:
-
-   ```bash
-   git tag v0.17.0
-   git push origin v0.17.0
-
-   # or via Makefile
-   make tag TAG=v0.17.0
-   ```
-
-3. Verify:
-
-   ```bash
-   curl -s https://ekmp-assets.everkm.com/pkgs/latest.json
-   npm view everkm-publish version
-   ```
-
-Manual re-run: GitHub Actions → **Publish NPM Package** → `workflow_dispatch`.
-
-Required secrets: `CF_S3_AK`, `CF_S3_SK`, `QINIU_ACCESS_KEY`, `QINIU_SECRET_KEY`, `GH_TOKEN`, `NPM_TOKEN`, `NOTIFY_DAYU_ENDPOINT`。
+Maintainers: see [README-MAINTAINERS.md](./README-MAINTAINERS.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "everkm-publish",
-  "version": "0.17.0",
+  "version": "0.17.2",
   "description": "Everkm Publish CLI — npm wrapper with platform binaries",
   "repository": {
     "type": "git",

package/scripts/publish-npm-package.py

@@ -4,7 +4,7 @@
 publish-npm-package.py
 
 从 everkm/publish GitHub Release 拉取全部资产，镜像至 R2 / 七牛（pkgs/{ver}/），
-生成 pkgs/latest.json（含上游 Release notes）。
+生成 pkgs/latest.json 与 pkgs/{ver}/meta.json（含上游 Release notes）。
 
 环境变量：
 - GH_TOKEN / GITHUB_TOKEN — 读 everkm/publish Release
@@ -241,6 +241,8 @@ def cdn_assets_complete(s3_client: Any, version: str, asset_names: list[str]) ->
     for name in asset_names:
         if not object_exists(s3_client, pkg_key(version, name)):
             return False
+    if not object_exists(s3_client, pkg_key(version, "meta.json")):
+        return False
     latest_key = "pkgs/latest.json"
     if not object_exists(s3_client, latest_key):
         return False
@@ -249,6 +251,7 @@ def cdn_assets_complete(s3_client: Any, version: str, asset_names: list[str]) ->
 
 def cdn_refresh_urls(version: str, asset_names: list[str]) -> None:
     urls = [f"{CDN_CN}/pkgs/{version}/{name}" for name in asset_names]
+    urls.append(f"{CDN_CN}/pkgs/{version}/meta.json")
     urls.append(f"{CDN_CN}/pkgs/latest.json")
     ak = os.environ.get("QINIU_ACCESS_KEY")
     sk = os.environ.get("QINIU_SECRET_KEY")
@@ -324,10 +327,22 @@ def publish(
                 skip_if_exists=not force_cdn,
             )
 
-        latest = build_latest_json(version, tag, notes, asset_names)
+        meta = build_latest_json(version, tag, notes, asset_names)
+
+        meta_path = work_dir / "meta.json"
+        with meta_path.open("w", encoding="utf-8") as f:
+            json.dump(meta, f, indent=2, ensure_ascii=False)
+            f.write("\n")
+        upload_file_both(
+            s3_client,
+            meta_path,
+            pkg_key(version, "meta.json"),
+            skip_if_exists=not force_cdn,
+        )
+
         latest_path = work_dir / "latest.json"
         with latest_path.open("w", encoding="utf-8") as f:
-            json.dump(latest, f, indent=2, ensure_ascii=False)
+            json.dump(meta, f, indent=2, ensure_ascii=False)
             f.write("\n")
         upload_file_both(
             s3_client,