oc2-ulw-plan 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +18 -5
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -75,7 +75,7 @@ curl -fsSL https://raw.githubusercontent.com/beiyanpiki/oc2-ulw-plan/main/script
|
|
|
75
75
|
Or run the script from a checkout:
|
|
76
76
|
|
|
77
77
|
```bash
|
|
78
|
-
./scripts/install-release.sh --version v0.2.
|
|
78
|
+
./scripts/install-release.sh --version v0.2.1 --global
|
|
79
79
|
```
|
|
80
80
|
|
|
81
81
|
### From a checkout
|
|
@@ -319,10 +319,23 @@ default verification because it needs a configured provider and can spend money.
|
|
|
319
319
|
pushes to `main` and on pull requests.
|
|
320
320
|
- `.github/workflows/release.yml` runs on `v*` tags. It re-runs the checks,
|
|
321
321
|
builds `npm pack`, creates or updates the GitHub release with the tarball and
|
|
322
|
-
`scripts/install-release.sh`, and publishes the tarball to npm
|
|
323
|
-
|
|
324
|
-
|
|
325
|
-
|
|
322
|
+
`scripts/install-release.sh`, and publishes the tarball to npm with
|
|
323
|
+
**Trusted Publishing (OIDC)**. No long-lived npm token is stored in CI.
|
|
324
|
+
- Configure the npm trusted publisher once on npmjs.com (or with the npm CLI,
|
|
325
|
+
which prompts for 2FA):
|
|
326
|
+
- provider: GitHub Actions
|
|
327
|
+
- organization/user: `beiyanpiki`
|
|
328
|
+
- repository: `oc2-ulw-plan`
|
|
329
|
+
- workflow filename: `release.yml`
|
|
330
|
+
- allowed actions: `npm publish`
|
|
331
|
+
```bash
|
|
332
|
+
npm trust github oc2-ulw-plan --repo beiyanpiki/oc2-ulw-plan --file release.yml --allow-publish
|
|
333
|
+
```
|
|
334
|
+
- A newly created trusted publisher must complete its first publish within two
|
|
335
|
+
days. After the first publish, the configuration is validated and bound to the
|
|
336
|
+
repository's immutable identity.
|
|
337
|
+
- Recommended after the first publish: package Settings → Publishing access →
|
|
338
|
+
require 2FA and disallow token publishing.
|
|
326
339
|
- To cut a release: update `package.json`, commit, then
|
|
327
340
|
`git tag vX.Y.Z && git push origin main --tags`. The tag must match the
|
|
328
341
|
package version; the workflow refuses a mismatch.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "oc2-ulw-plan",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.1",
|
|
4
4
|
"description": "OpenCode V2 spec planning and execution workflow: /ulw-plan, /ulw-execute, /ulw-status with frozen specs, evidence and independent review.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|