ekklesiaandClaude Opus 5.5
d3c62e63bf
CI / verify (pull_request) Successful in 1m1s
CI / infrastructure-smoke (pull_request) Successful in 35s
CI / migration-smoke (pull_request) Successful in 1m53s
CI / package-release (pull_request) Failing after 43s
CI / package-publication (pull_request) Skipped
CI / image-build (pull_request) Successful in 29s
CI / deploy-smoke (split) (pull_request) Canceled after 0s
CI / deploy-smoke (same-origin) (pull_request) Canceled after 38s
Publishes one package release train to the Gitea npm registry under River_of_Glory_Church, whose packages are publicly readable on purpose: exactly the .tgz files the package-release gate proved, and nothing else. Nothing is published by this change. - scripts/publish-package-train.ts validates the whole local train before any request (gate manifest hash, version, revision, unmodified source, the nine packages, every artifact's size, SHA-256, integrity, SHA256SUMS line, and inner package.json), then publishes in dependency order with `npm publish <file.tgz>` under a staging tag. Each package is reconciled first (absent: publish; same bytes: accept; other bytes: hard stop, version burned), then read back: metadata (name, version, integrity, dependency maps, normalized bin, tarball on the registry) and the tarball itself, byte for byte, also anonymously. `latest` moves only after all nine verify; reruns converge and never delete anything. It writes a publication record. The token comes from EKKLESIA_PACKAGES_PUBLISH_TOKEN only, through a temporary npm config that refers to the variable. - scripts/test-package-publication.sh proves it against a disposable Gitea 1.27.2 with public owners, a publisher team and an outsider: anonymous reads, refused unauthorized publishing, byte-identical round trips, the registry's own 409, partial-train recovery, the burned version hard stop, and dist-tag retry convergence. - CI: package-release keeps its proven release and hands it on as an artifact with its manifest hash; the new package-publication job publishes exactly that artifact to the disposable Gitea. Artifact actions v3 (node20): v4 refuses any server other than github.com. - .github/workflows/publish-packages.yml publishes to the real registry only by manual dispatch on main, after its own gate run, with the secret in the publish step alone. - docs: the public-read model, the workflow, the record, credentials, immutability policy, provider moves, and the first-publication steps. Co-Authored-By: Claude Opus 5.5 <[email protected]>
61 lines
3.4 KiB
JSON
61 lines
3.4 KiB
JSON
{
|
|
"name": "ekklesia",
|
|
"version": "0.1.2",
|
|
"license": "AGPL-3.0-or-later",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "Open, modular church technology platform",
|
|
"engines": {
|
|
"node": ">=24.11.0 <25",
|
|
"pnpm": ">=11.12.0 <12"
|
|
},
|
|
"packageManager": "[email protected]",
|
|
"scripts": {
|
|
"api:start": "turbo run build && node --env-file-if-exists=.env apps/api/dist/server.js",
|
|
"authorization:bootstrap-owner": "turbo run build && node --env-file-if-exists=.env core/dist/cli/bootstrap-platform-owner.js",
|
|
"boundaries": "node scripts/check-boundaries.ts",
|
|
"build": "turbo run build",
|
|
"ci:verify": "pnpm verify && pnpm infrastructure:config && pnpm deploy:config",
|
|
"deploy:config": "bash scripts/check-deploy-config.sh",
|
|
"deploy:smoke": "bash scripts/smoke-deploy.sh",
|
|
"doctor": "node scripts/run-doctor.ts",
|
|
"format": "biome format --write .",
|
|
"format:check": "biome format .",
|
|
"identity:create-initial-owner": "turbo run build && node --env-file-if-exists=.env core/dist/cli/create-initial-owner.js",
|
|
"identity:schema:validate": "turbo run build && node core/dist/cli/validate-identity-schema.js",
|
|
"infrastructure:config": "docker compose --env-file .env.example -f infrastructure/compose.yaml config --quiet",
|
|
"infrastructure:down": "docker compose --env-file .env -f infrastructure/compose.yaml down",
|
|
"infrastructure:logs": "docker compose --env-file .env -f infrastructure/compose.yaml logs --follow",
|
|
"infrastructure:smoke": "bash scripts/smoke-infrastructure.sh",
|
|
"infrastructure:up": "docker compose --env-file .env -f infrastructure/compose.yaml up --detach --wait",
|
|
"lint": "turbo run lint lint:root",
|
|
"lint:root": "biome lint .",
|
|
"migrations:apply": "turbo run build && node --env-file-if-exists=.env core/dist/cli/apply-migrations.js",
|
|
"migrations:plan": "turbo run build && node --env-file-if-exists=.env core/dist/cli/plan-migrations.js",
|
|
"migrations:validate": "turbo run build && node core/dist/cli/validate-migrations.js",
|
|
"modules:disable": "turbo run build && node --env-file-if-exists=.env core/dist/cli/set-module-enabled.js --disable",
|
|
"modules:enable": "turbo run build && node --env-file-if-exists=.env core/dist/cli/set-module-enabled.js --enable",
|
|
"modules:pack": "turbo run build && node packages/module-pack/bin/ekklesia-pack-module.mjs",
|
|
"modules:validate": "turbo run build && node core/dist/cli/validate-modules.js",
|
|
"modules:verify-package": "turbo run build && node core/dist/cli/verify-module-package.js",
|
|
"packages:release": "node scripts/package-release.ts --out .package-release",
|
|
"test": "turbo run test test:root",
|
|
"test:migrations:integration": "pnpm build && bash scripts/test-migrations-integration.sh",
|
|
"test:root": "vitest run --config vitest.config.ts",
|
|
"test:package-release": "bash scripts/test-package-release.sh",
|
|
"test:package-publication": "bash scripts/test-package-publication.sh",
|
|
"test:watch": "vitest",
|
|
"typecheck": "turbo run typecheck typecheck:root",
|
|
"typecheck:root": "tsc --noEmit --project tsconfig.json",
|
|
"verify": "pnpm format:check && pnpm lint && pnpm boundaries && pnpm typecheck && pnpm test && pnpm modules:validate && pnpm migrations:validate && pnpm identity:schema:validate && pnpm build"
|
|
},
|
|
"devDependencies": {
|
|
"@biomejs/biome": "2.5.3",
|
|
"@types/node": "24.13.3",
|
|
"turbo": "2.10.4",
|
|
"typescript": "7.0.2",
|
|
"vitest": "4.1.10",
|
|
"yaml": "2.9.0"
|
|
}
|
|
}
|