harness-alchemist 0.1.9 → 0.1.10

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "harness-alchemist",
   "displayName": "Harness Alchemist",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
   "author": {
     "name": "Haochuan Zhang"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-alchemist",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
   "author": {
     "name": "Haochuan Zhang",

package/README.md

@@ -161,10 +161,16 @@ and the DeepSeek Cordis check require npm mode with built adapters
 
 ## Release automation
 
+The npm package trusts GitHub Actions workflow `npm-publish.yml` in
+`lunarmoon26/harness-alchemist`. The workflow uses OIDC instead of an
+`NPM_TOKEN`, requires the tag to match the committed package version, and
+accepts only commits contained in `main`.
+
 ```bash
 # bump package.json version, then:
 npm run sync && npm run verify && git commit -am "Release vX.Y.Z" && git push
-git tag vX.Y.Z && git push origin vX.Y.Z   # publishes automatically
+# after the release commit is merged to main:
+git tag vX.Y.Z && git push origin vX.Y.Z   # publishes through npm Trusted Publishing
 ```
 
 ## License

package/alchemy.json

@@ -3,6 +3,6 @@
   "runtime": "npm",
   "template": "v0.1.0",
   "generator": "harness-alchemist",
-  "generatorVersion": "0.1.9",
+  "generatorVersion": "0.1.10",
   "createdAt": "2026-08-24T00:00:00.000Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-alchemist",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
   "type": "module",
   "bin": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-alchemist",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
   "author": {
     "name": "Haochuan Zhang"

package/skills/harness-alchemist/references/publishing.md

@@ -57,13 +57,15 @@ The package root exports OpenCode. The `./deepseek` subpath exports Cordis. Keep
 ## GitHub Release Publishing
 
 `.github/workflows/npm-publish.yml` publishes when a `vX.Y.Z` tag is pushed
-(or a GitHub release with a semver tag such as `vX.Y.Z-rc.1` is published);
-the workflow applies that version to `package.json`, runs
-`npm run sync`, verifies the package, and publishes it with npm provenance.
-
-Configure the repository `NPM_TOKEN` secret with an npm publish token before
-pushing the tag. The workflow never publishes from pull requests or branch
-pushes.
+(including a prerelease tag such as `vX.Y.Z-rc.1`). The workflow requires the
+tag to match the committed `package.json` version, checks that the tagged
+commit is contained in `main`, verifies synchronized metadata and the package,
+then publishes through npm Trusted Publishing with provenance.
+
+Before the first release, configure the npm package's Trusted Publisher for
+GitHub Actions with the repository owner, repository name, workflow filename
+`npm-publish.yml`, and no environment. Do not create an `NPM_TOKEN` secret.
+The workflow never publishes from pull requests or branch pushes.
 
 ## Public Catalog Metadata
 

package/templates/v0.1.0/universal-typescript/.github/workflows/npm-publish.yml.tpl

@@ -7,43 +7,59 @@ on:
 
 permissions:
   contents: read
-  id-token: write
+
+concurrency:
+  group: npm-publish-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   publish:
+    name: Publish package
     if: github.event.created && !github.event.deleted
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write # Required for npm Trusted Publishing OIDC.
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          node-version: 22.20.0
+          node-version: "24.19.0"
           registry-url: https://registry.npmjs.org
-      - uses: oven-sh/setup-bun@v2
+          package-manager-cache: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.2.0
+          bun-version: 1.4.0
+          no-cache: true
 
-      - name: Resolve release version
-        id: version
+      - name: Verify release tag
         shell: bash
         run: |
-          TAG="${{ github.ref_name }}"
-          VERSION="${TAG#v}"
-          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
-            echo "::error::Tag '$TAG' is not a valid semver version"
+          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
+          EXPECTED_TAG="v${PACKAGE_VERSION}"
+          if [[ "$GITHUB_REF_NAME" != "$EXPECTED_TAG" ]]; then
+            echo "::error::Tag '$GITHUB_REF_NAME' must match package version '$EXPECTED_TAG'"
+            exit 1
+          fi
+
+          git fetch --no-tags origin main:refs/remotes/origin/main
+          TAG_COMMIT="$(git rev-list -n 1 "$GITHUB_REF_NAME")"
+          if ! git merge-base --is-ancestor "$TAG_COMMIT" refs/remotes/origin/main; then
+            echo "::error::Release tag '$GITHUB_REF_NAME' must point to a commit contained in main"
             exit 1
           fi
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - run: npm ci
-      - name: Set package version from tag
-        run: npm version "${{ steps.version.outputs.version }}" --no-git-tag-version --allow-same-version
-      - run: npm run sync
+      - name: Verify synchronized metadata
+        run: |
+          npm run sync
+          git diff --exit-code
       - run: npm run verify
       - name: Verify npm package contents
         run: npm pack --dry-run
       - name: Publish npm package
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --access public

package/templates/v0.1.0/universal-typescript/README.md.tpl

@@ -57,12 +57,14 @@ npm pack --dry-run
 ## GitHub Release Publishing
 
 `.github/workflows/npm-publish.yml` publishes when a `vX.Y.Z` tag is pushed
-(or a GitHub release with a semver tag such as `vX.Y.Z-rc.1` is published);
-the workflow applies that version, synchronizes manifests,
-verifies the package, and publishes with npm provenance.
-
-Configure the repository `NPM_TOKEN` secret with an npm publish token before
-pushing the tag.
+(including a prerelease tag such as `vX.Y.Z-rc.1`). The workflow requires the
+tag to match the committed `package.json` version, checks that the tagged
+commit is contained in `main`, verifies synchronized metadata and the package,
+then publishes through npm Trusted Publishing with provenance.
+
+Before the first release, configure the npm package's Trusted Publisher for
+GitHub Actions with the repository owner, repository name, workflow filename
+`npm-publish.yml`, and no environment. Do not create an `NPM_TOKEN` secret.
 
 ## Claude Code