gh-glance 0.3.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +32 -0
- package/README.md +23 -2
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,37 @@ All notable changes to this project are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [0.3.1] - 2026-08-04
|
|
9
|
+
|
|
10
|
+
First release published by CI rather than from a laptop, and the first carrying
|
|
11
|
+
an [npm provenance
|
|
12
|
+
attestation](https://docs.npmjs.com/generating-provenance-statements) linking
|
|
13
|
+
the tarball to the workflow run and commit that built it.
|
|
14
|
+
|
|
15
|
+
### Fixed
|
|
16
|
+
|
|
17
|
+
- **The install instructions on the npm page told you to clone the
|
|
18
|
+
repository.** `README.md` ships inside the tarball, and the copy published
|
|
19
|
+
with `0.3.0` still said "Not yet published to npm -- clone + `npm link` is
|
|
20
|
+
the current install path". It was written before there was a package and was
|
|
21
|
+
false the moment one existed. `npm install -g gh-glance` is now the first
|
|
22
|
+
thing the page shows.
|
|
23
|
+
|
|
24
|
+
### Added
|
|
25
|
+
|
|
26
|
+
- **Publishing is automatic and credential-free.** Publishing a GitHub release
|
|
27
|
+
builds and publishes from the tagged commit via OIDC trusted publishing.
|
|
28
|
+
There is no `NPM_TOKEN` in the repository and there will not be one: npm
|
|
29
|
+
revoked all classic tokens in December 2025, removed account and package
|
|
30
|
+
management from bypass-2FA granular tokens in August 2026, and removes their
|
|
31
|
+
direct-publish ability in January 2027.
|
|
32
|
+
- The release workflow now installs the packed tarball globally and runs the
|
|
33
|
+
binary before publishing, so a dropped `files` entry or a broken bin shebang
|
|
34
|
+
fails the release rather than the next person's install. It also refuses a
|
|
35
|
+
tag that is not reachable from `main` or that does not point at the commit
|
|
36
|
+
being built, and skips a version that is already on the registry rather than
|
|
37
|
+
hard-failing on `E403`.
|
|
38
|
+
|
|
8
39
|
## [0.3.0] - 2026-08-03
|
|
9
40
|
|
|
10
41
|
The dashboard stops being read-only: you can now move through the table and open
|
|
@@ -196,5 +227,6 @@ engineering, security, QA and UX. What follows is what changed as a result.
|
|
|
196
227
|
- The `main` field from `package.json`. It advertised the file as importable,
|
|
197
228
|
but importing it took over the terminal or exited the host process.
|
|
198
229
|
|
|
230
|
+
[0.3.1]: https://github.com/juan294/gh-glance/releases/tag/v0.3.1
|
|
199
231
|
[0.3.0]: https://github.com/juan294/gh-glance/releases/tag/v0.3.0
|
|
200
232
|
[0.2.0]: https://github.com/juan294/gh-glance/releases/tag/v0.2.0
|
package/README.md
CHANGED
|
@@ -94,6 +94,25 @@ current.
|
|
|
94
94
|
|
|
95
95
|
## Install
|
|
96
96
|
|
|
97
|
+
```bash
|
|
98
|
+
npm install -g gh-glance
|
|
99
|
+
```
|
|
100
|
+
|
|
101
|
+
That is the whole install. `gh-glance` ships as a single `index.mjs` with no
|
|
102
|
+
build step, so there is nothing to compile and nothing to configure -- the
|
|
103
|
+
package is the source you can read in this repository.
|
|
104
|
+
|
|
105
|
+
Every published version is built and signed by GitHub Actions from a tagged
|
|
106
|
+
commit on `main`, never from a maintainer's laptop, and carries [npm
|
|
107
|
+
provenance](https://docs.npmjs.com/generating-provenance-statements) linking
|
|
108
|
+
the tarball back to the workflow run and commit that produced it. The
|
|
109
|
+
"Provenance" section on the [package
|
|
110
|
+
page](https://www.npmjs.com/package/gh-glance) shows the exact source.
|
|
111
|
+
|
|
112
|
+
### From a clone
|
|
113
|
+
|
|
114
|
+
For hacking on it, or to run an unreleased revision:
|
|
115
|
+
|
|
97
116
|
```bash
|
|
98
117
|
git clone https://github.com/juan294/gh-glance.git
|
|
99
118
|
cd gh-glance
|
|
@@ -101,8 +120,6 @@ npm install
|
|
|
101
120
|
npm link # makes the `gh-glance` command available globally
|
|
102
121
|
```
|
|
103
122
|
|
|
104
|
-
(Not yet published to npm -- clone + `npm link` is the current install path.)
|
|
105
|
-
|
|
106
123
|
`npm link` is what puts `gh-glance` on your `PATH`; it symlinks the global
|
|
107
124
|
bin at your Node version's `bin/` directory through to this checkout:
|
|
108
125
|
|
|
@@ -117,6 +134,10 @@ it, and both are fixed by re-running `npm link` from the clone:
|
|
|
117
134
|
- switching Node versions (nvm/fnm install their own global `bin/`)
|
|
118
135
|
- setting up on a fresh machine, or after `npm unlink -g gh-glance`
|
|
119
136
|
|
|
137
|
+
A linked clone shadows a global install, since both write the same bin name.
|
|
138
|
+
Run `npm unlink -g gh-glance` before `npm install -g gh-glance` if you want
|
|
139
|
+
to go back to the published version.
|
|
140
|
+
|
|
120
141
|
### Using it as a workspace pane
|
|
121
142
|
|
|
122
143
|
`gh-glance` takes no arguments and infers the repo from the working
|
package/package.json
CHANGED