release: npm publishing setup for @modularcloud/xspec - #3
Merged
Conversation
Triage of the npm-publishing seed: SPEC.md exists and the change requires no SPEC.md update (distribution is not part of the product contract), so this is a bug-classified patch. Substance: first publish of @modularcloud/xspec, standing automated releases from main, release logic recorded in DEVOPS.md, concise manual checklist for Developer-credential steps. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…t a patch Developer ruling (2026-07-28): the npm-publishing request is a one-off release/setup task, not a patch — it changes no product behavior and its substance is release machinery owned by DEVOPS.md. The patch document is therefore retired unmerged; its content remains in git history (fd52b99). The release setup itself follows on this branch under Phase 11 authority. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…this repository The metadata predated the product's relocation: it named the package xspec (unscoped) and pointed at the retired modularcloud/sdg-claude repository. The published artifact must identify as @modularcloud/xspec with modularcloud/xspec as its home, so: scoped name, repository/ homepage/bugs URLs to this repository, public access for the scoped package, a user-facing description and keywords, and version 0.1.0 as the first-release baseline. Product behavior is unchanged; the tarball remains dist-only (npm pack --dry-run: 151 files). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Every push to main whose CI run concludes green is published to the public npm registry as @modularcloud/xspec and tagged vX.Y.Z, with no human involvement per release. The Release workflow triggers on CI completion for main pushes (the never-release-with-red-CI rule enforced mechanically), checks out exactly the commit CI validated, and computes a strictly increasing version via .github/scripts/next-version.mjs: package.json's version when it exceeds the latest published version (deliberate bumps land as ordinary package.json changes), otherwise the latest published version patch-incremented. Publishing authenticates with the NPM_TOKEN repository secret and attaches npm provenance; a missing secret fails the run loudly with instructions rather than silently skipping the release. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Supersedes the deferred-release section written when the product lived in modularcloud/sdg-claude: this repository is now the product's home, so that deferral (and release candidate 9316048) is history, kept as a one-line note. Records the standing Developer authorization of 2026-07-28 for npm publishes and release tags, the automated release procedure (trigger, gate, versioning, tags, credentials model, failure handling), and the resulting Release-phase flow for future patches: merge on green, automation does the rest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
lzrscg
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One-off release/setup work under Phase 11 authority (specs/DEVOPS.md), per Developer ruling of 2026-07-28: npm publishing is release machinery, not a patch.
specs/patches/0001-npm-publishing.mdwas drafted before the ruling and is deleted; its content stays in git history (fd52b99).package.jsonnow names the package@modularcloud/xspecwith this repository as its home (repository/homepage/bugs), public access, a user-facing description, and0.1.0as the first-release baseline. Product behavior unchanged; tarball stays dist-only..github/workflows/release.ymlpublishes every greenmainpush to the public npm registry with a strictly increasing version (computed by.github/scripts/next-version.mjs) and tags the released commitvX.Y.Z. Gated on the CI workflow's own success; authenticates via theNPM_TOKENrepository secret; fails loudly (never silently skips) while the secret is unset.Merging this PR also lands the pending PHILOSOPHY.md liaison update (
aec65ee). First publish fires by re-running the failed Release run once theNPM_TOKENsecret is set (checklist handed to Developer), or automatically on the nextmainlanding after that.🤖 Generated with Claude Code