kataster 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +9 -0
- package/README.md +7 -0
- package/guide/release.md +40 -10
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,14 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.2.1 – 2026-10-31
|
|
4
|
+
|
|
5
|
+
- Releases are published from CI with npm trusted publishing (OIDC): pushing a `v*` tag runs the type check and the
|
|
6
|
+
test suite, verifies that the tag matches `package.json`, and publishes with provenance attestations – no token
|
|
7
|
+
in the repository, no one-time password. `guide/release.md` documents the setup and the manual fallback.
|
|
8
|
+
- The repository is maintained in the open: `CONTRIBUTING.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`, issue and pull
|
|
9
|
+
request templates, Dependabot for the tooling dependencies and a protected `main` (pull request required, green
|
|
10
|
+
CI, squash only).
|
|
11
|
+
|
|
3
12
|
## 0.2.0 – 2026-10-31
|
|
4
13
|
|
|
5
14
|
- **Renamed from La Guardia to Kataster.** The CLI is `npx kataster`, the state directory is `.kataster/`, the
|
package/README.md
CHANGED
|
@@ -320,6 +320,13 @@ The name is a historical reference, not a domain: the workflow has none of its o
|
|
|
320
320
|
was removed when the package was extracted – the examples are neutral, the stack is detected, and the language is
|
|
321
321
|
yours.
|
|
322
322
|
|
|
323
|
+
## Contributing
|
|
324
|
+
|
|
325
|
+
The toolkit is maintained in the open: bug reports, a skill that fills a real gap and sharper prompts are welcome.
|
|
326
|
+
[CONTRIBUTING.md](CONTRIBUTING.md) has the setup, the payload rules and the release process;
|
|
327
|
+
[SECURITY.md](SECURITY.md) is the way to report a vulnerability privately. Participation is covered by the
|
|
328
|
+
[Code of Conduct](CODE_OF_CONDUCT.md).
|
|
329
|
+
|
|
323
330
|
## License
|
|
324
331
|
|
|
325
332
|
MIT
|
package/guide/release.md
CHANGED
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
npm install --prefix .claude --no-audit --no-fund
|
|
12
12
|
npm run typecheck --prefix .claude
|
|
13
13
|
npm test
|
|
14
|
-
npm pack --dry-run #
|
|
14
|
+
npm pack --dry-run # 162 files, 256 kB – no examples/, no node_modules, no state/
|
|
15
15
|
```
|
|
16
16
|
|
|
17
17
|
4. Install the tarball once and start a throwaway project with it – a tarball that installs is not the same as a
|
|
@@ -26,6 +26,42 @@ kataster doctor /tmp/smoke
|
|
|
26
26
|
|
|
27
27
|
## 2. Publish
|
|
28
28
|
|
|
29
|
+
### Through CI (the normal case)
|
|
30
|
+
|
|
31
|
+
The tag publishes. `v0.2.0` starts `.github/workflows/release.yml`, which checks that the tag matches
|
|
32
|
+
`package.json`, runs the type check and the suite, then publishes over OIDC – no npm token in the repository, no
|
|
33
|
+
one-time password, and provenance attestations are written automatically.
|
|
34
|
+
|
|
35
|
+
```bash
|
|
36
|
+
git push origin main
|
|
37
|
+
git tag -a v0.2.0 -m "Kataster 0.2.0"
|
|
38
|
+
git push origin v0.2.0
|
|
39
|
+
gh run watch
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
If the tag and `package.json` disagree, the workflow fails before it publishes – bump the version first, then tag.
|
|
43
|
+
|
|
44
|
+
### The first time only: trusted publisher
|
|
45
|
+
|
|
46
|
+
npm has to know which workflow may publish. On npmjs.com → `kataster` → Settings → **Trusted publishing** →
|
|
47
|
+
GitHub Actions:
|
|
48
|
+
|
|
49
|
+
| Field | Value |
|
|
50
|
+
|---|---|
|
|
51
|
+
| Organization or user | `hemi1986` |
|
|
52
|
+
| Repository | `kataster` |
|
|
53
|
+
| Workflow filename | `release.yml` |
|
|
54
|
+
| Environment name | – (leave empty) |
|
|
55
|
+
| Allowed actions | **Allow npm publish** (the default `npm stage publish` alone is not enough) |
|
|
56
|
+
|
|
57
|
+
The first publish has to succeed within **two days**, otherwise the configuration expires and has to be created
|
|
58
|
+
again. Once it works, lock the old path down: Settings → **Publishing access** → "Require two-factor authentication
|
|
59
|
+
and disallow tokens". Trusted publishers keep working; tokens and OTP stop working.
|
|
60
|
+
|
|
61
|
+
### By hand (fallback)
|
|
62
|
+
|
|
63
|
+
If CI is unavailable or a version has to go out without a tag:
|
|
64
|
+
|
|
29
65
|
```bash
|
|
30
66
|
npm login # once per machine
|
|
31
67
|
npm publish --access public
|
|
@@ -33,21 +69,15 @@ npm publish --access public
|
|
|
33
69
|
|
|
34
70
|
`prepublishOnly` runs the test suite, so a red suite cannot be published.
|
|
35
71
|
|
|
36
|
-
Verify
|
|
72
|
+
## 3. Verify
|
|
37
73
|
|
|
38
74
|
```bash
|
|
39
75
|
npm view kataster version
|
|
40
76
|
npx kataster@latest --version
|
|
41
77
|
```
|
|
42
78
|
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
The tag is the version with a `v`:
|
|
46
|
-
|
|
47
|
-
```bash
|
|
48
|
-
git tag -a v0.2.0 -m "Kataster 0.2.0"
|
|
49
|
-
git push origin main v0.2.0
|
|
50
|
-
```
|
|
79
|
+
The package page shows a provenance badge (`built and signed on GitHub Actions`) and the workflow run is linked to
|
|
80
|
+
the tag. A missing badge means the publish did not go through trusted publishing.
|
|
51
81
|
|
|
52
82
|
## What ships
|
|
53
83
|
|
package/package.json
CHANGED