feat!: publish as @deepcode/cli and release on partial credentials - #249
Merged
Conversation
BREAKING CHANGE: the CLI publishes as @deepcode/cli. Install with `npm i -g @deepcode/cli`. The binary is still `deepcode`. The unscoped `deepcode-cli` on npm belongs to an unrelated project (guocong-bincai/deepcode-cli, currently 1.3.2), so publishing under that name was never possible — `pnpm publish` would have 403'd. A scope we control also removes the squatting risk permanently. Historical snapshots (MORNING_REPORT, DEVELOPMENT_PLAN, HANDOFF, BEHAVIOR_PARITY, release-artifacts) keep the old name; they record what was true when written. Separately, the release graph no longer requires every credential to exist. validate detects which secrets are configured and skips the legs that cannot run: no Apple secrets skips build-mac, no NPM_TOKEN skips publish-cli. Skipped rather than failed — a red release for a missing credential teaches people to ignore red releases. A job that actually fails still blocks the release, and the anti-partial-release rule stands: npm publication still waits on both installable artifacts. github-release now runs on what was actually built, and states in the release body which artifacts are absent and why. A release page missing a DMG otherwise reads as "there is no Mac build" rather than "it was not produced this time". Caught by typecheck: `@deepcode/cli` inside a regex literal terminates it early. That assertion is now a toContain. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the two decisions that were blocking v0.3.0.
1. Rename to
@deepcode/cliThe unscoped
deepcode-clion npm belongs to an unrelated project —guocong199708,guocong-bincai/deepcode-cli, currently 1.3.2, a Doubao-based CLI.apps/cli/package.jsonclaimed that exact name, sopnpm publishwould have 403'd. It was never ours to publish to.A scope we control also removes the squatting risk permanently.
Updated: the package name, the install line in
README.md/quickstart.md/MIGRATION_FROM_CLAUDE_CODE.md/apps/cli/README.md, the/upgradeanddeepcode upgradehints, andRELEASING.md's verification command.Historical snapshots keep the old name —
MORNING_REPORT.md,DEVELOPMENT_PLAN.md,HANDOFF.md,BEHAVIOR_PARITY.md,release-artifacts/README.md. They record what was true when written, andcheck-docs.mjsalready marks them as such.pnpm install --frozen-lockfilestill resolves: pnpm keys importers by path, not package name.2. Release on the credentials that exist
validatenow detects which secret sets are configured and publishes them as outputs. The check lives in a step because thesecretscontext isn't available in a job-levelif.build-macskipped — no DMGNPM_TOKENpublish-cliskipped — nothing published to npmSkipped, not failed. A red release for a missing credential teaches people to ignore red releases. A job that actually fails still blocks the release —
github-release's guard isneeds.build-mac.result != 'failure', not== 'success', so a broken build never becomes a release while an unattempted one doesn't hold it hostage.The anti-partial-release rule stands: npm publication still waits on both installable artifacts. It just additionally requires a token to exist.
The release page says what's missing
Without this, a release page missing a DMG reads as "there is no Mac build for this project" rather than "it wasn't produced this time".
Test plan
pnpm test— 1414 passed, 16 skippedpnpm typecheck·pnpm lint·pnpm format:check·pnpm build·node scripts/check-docs.mjspnpm install --frozen-lockfileclean after the renamedeepcode-clireference and classified each as user-facing (renamed) or historical (kept)Typecheck caught a real one:
/npm i -g @deepcode/cli@latest/— the/in the scope terminates the regex literal. That assertion is now atoContain. Worth flagging because a scoped rename inside regexes is exactly what slips through a find-and-replace.Documentation
docs/RELEASING.md— partial-credential behaviour table, and a note that the@deepcodescope must exist and the token must publish into it (the workflow already passes--access public, which scoped packages need)CHANGELOG.md— rename under BreakingRelease notes label
release-notes:breaking— the install command changesRelated
Follows #246, #247, #248. Unblocks the v0.3.0 release (#245).
🤖 Generated with Claude Code