feishu-codex-console 1.0.0-beta.6 → 1.0.0-beta.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +6 -0
- package/docs/INSTALLATION.md +3 -3
- package/docs/RELEASE_CHECKLIST.md +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,12 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes are recorded here. Versions follow Semantic Versioning while the public API stabilizes.
|
|
4
4
|
|
|
5
|
+
## 1.0.0-beta.7 - 2026-07-17
|
|
6
|
+
|
|
7
|
+
### Changed
|
|
8
|
+
|
|
9
|
+
- npm releases now use GitHub OIDC trusted publishing with job-scoped permissions and no long-lived repository token; prerelease tags create correctly marked GitHub prereleases.
|
|
10
|
+
|
|
5
11
|
## 1.0.0-beta.6 - 2026-07-17
|
|
6
12
|
|
|
7
13
|
### Fixed
|
package/docs/INSTALLATION.md
CHANGED
|
@@ -194,13 +194,13 @@ npx feishu-codex-console migrate --from /absolute/path/to/old/feishu-codex-bridg
|
|
|
194
194
|
|
|
195
195
|
## 维护者发布
|
|
196
196
|
|
|
197
|
-
每次推送 `v<package version>` 标签时，Release workflow 会重新运行类型检查、测试、生产构建和 tarball
|
|
197
|
+
每次推送 `v<package version>` 标签时，Release workflow 会重新运行类型检查、测试、生产构建和 tarball 干净安装测试，然后通过 GitHub OIDC 可信发布生成 npm provenance，并创建 GitHub Release。
|
|
198
198
|
|
|
199
199
|
仓库需要配置：
|
|
200
200
|
|
|
201
201
|
- GitHub Environment：`npm`，建议要求维护者审批。
|
|
202
|
-
- Environment
|
|
203
|
-
- npm
|
|
202
|
+
- npm 包的 Trusted Publisher：GitHub Actions、仓库 `LeoChaseYoung/feishu-codex-console`、工作流 `release.yml`、Environment `npm`，仅允许 `npm publish`。
|
|
203
|
+
- npm 账号开启双因素认证；仓库和 Environment 不保存长期 `NPM_TOKEN`。
|
|
204
204
|
|
|
205
205
|
标签必须与 `package.json` 完全一致，例如 `1.0.0-beta.4` 对应 `v1.0.0-beta.4`。
|
|
206
206
|
|
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
- [ ] tarball 能初始化运行手册且绝不覆盖已有目录，并完成一次不带 `--yes` 的只读升级预览。
|
|
13
13
|
- [ ] `version --json` 与兼容矩阵中的 Codex、lark-cli、配置、状态和 SQLite 版本一致。
|
|
14
14
|
- [ ] `npm run release:check -- v<version>` 通过。
|
|
15
|
-
- [ ] npm
|
|
15
|
+
- [ ] npm 发布通过 GitHub OIDC Trusted Publisher 生成 provenance，仓库和 Environment 中不存在长期 `NPM_TOKEN`，预发布版本进入 `next` dist-tag。
|
|
16
16
|
|
|
17
17
|
这些门禁由 CI 和 Release workflow 执行；任一平台失败都不会进入 npm publish。
|
|
18
18
|
|
package/package.json
CHANGED