From e4dfc2c743a9d75813d36de0fb49d8b7f083aadf Mon Sep 17 00:00:00 2001
From: "fuzeone-bot[bot]" <fuzeone-bot[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 14:09:26 +0300
Subject: [PATCH] ci(security): publish @fuzefront/security-client via izzywdev
 alias workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add packages/security to lerna.json packages[] and root npm workspaces so
tooling and lerna change-detection see it. Add security-packages-publish.yml
(mirrors chat-packages-publish.yml) to publish the tsup build to GitHub
Packages as @izzywdev/fuzefront-security-client — the owner-scoped alias
that lets @fuzefront/security-client ship NOW under the izzywdev account
(GitHub Packages ties scope to repo owner, so the @fuzefront-scoped
packages-publish.yml stays a no-op until the org transfer).

Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com>
Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7
---
 .../workflows/security-packages-publish.yml   | 65 +++++++++++++++++++
 lerna.json                                    |  2 +-
 package.json                                  |  1 +
 3 files changed, 67 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/security-packages-publish.yml

diff --git a/.github/workflows/security-packages-publish.yml b/.github/workflows/security-packages-publish.yml
new file mode 100644
index 00000000..6ef9ac9f
--- /dev/null
+++ b/.github/workflows/security-packages-publish.yml
@@ -0,0 +1,65 @@
+# Publish the security client to GitHub Packages under the @izzywdev scope.
+#
+# GitHub Packages requires the npm scope to match the repository owner, so the
+# canonical @fuzefront/security-client name cannot publish until the org transfer
+# completes (see packages-publish.yml, which stays the long-term path and no-ops
+# until then). Consuming apps (FuzeSocial, Mendys) need the security client TODAY,
+# so this workflow publishes the same build under an owner-scoped alias name:
+#
+#   @fuzefront/security-client -> @izzywdev/fuzefront-security-client
+#
+# Consumers install via an npm alias so their imports keep the canonical name:
+#
+#   "@fuzefront/security-client": "npm:@izzywdev/fuzefront-security-client@^0.1.0"
+#
+# Once the org transfer lands and packages-publish.yml activates, consumers drop
+# the alias and this workflow is deleted. Publishing is idempotent: a version that
+# already exists in the registry is skipped, not overwritten. No git push / tag is
+# made, so master's required_signatures protection is never involved.
+name: Publish security client (alias scope)
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [master]
+    paths:
+      - 'packages/security/**'
+
+concurrency:
+  group: security-packages-publish
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    if: github.repository_owner == 'izzywdev'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: '20.x'
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@izzywdev'
+
+      - name: Build security client
+        working-directory: packages/security
+        run: |
+          npm install --workspaces=false --no-audit --no-fund
+          npm run build
+
+      - name: Publish @izzywdev/fuzefront-security-client
+        working-directory: packages/security
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION=$(npm pkg get version | tr -d '"')
+          npm pkg set name=@izzywdev/fuzefront-security-client
+          if npm view "@izzywdev/fuzefront-security-client@${VERSION}" version --registry=https://npm.pkg.github.com >/dev/null 2>&1; then
+            echo "@izzywdev/fuzefront-security-client@${VERSION} already published — skipping."
+          else
+            npm publish --registry=https://npm.pkg.github.com
+          fi
diff --git a/lerna.json b/lerna.json
index 4fa5a424..6450a188 100644
--- a/lerna.json
+++ b/lerna.json
@@ -2,7 +2,7 @@
   "$schema": "node_modules/lerna/schemas/lerna-schema.json",
   "version": "1.0.0",
   "npmClient": "npm",
-  "packages": ["backend", "frontend", "shared", "sdk", "task-manager-app", "services/email-service", "services/sms-service", "services/provisioning-service", "services/chat-service", "packages/chat-client", "packages/chat-ui", "packages/identity-ui", "design-system", "packages/i18n", "packages/i18n-translate", "packages/feature-flags"],
+  "packages": ["backend", "frontend", "shared", "sdk", "task-manager-app", "services/email-service", "services/sms-service", "services/provisioning-service", "services/chat-service", "packages/chat-client", "packages/chat-ui", "packages/identity-ui", "design-system", "packages/i18n", "packages/i18n-translate", "packages/feature-flags", "packages/security"],
   "command": {
     "version": {
       "allowBranch": ["main", "master", "develop"],
diff --git a/package.json b/package.json
index 9a64841c..d8ced502 100644
--- a/package.json
+++ b/package.json
@@ -17,6 +17,7 @@
     "packages/i18n",
     "packages/i18n-translate",
     "packages/feature-flags",
+    "packages/security",
     "design-system",
     "services/email-service"
   ],