feat(ci): publish tagged builds to the Forgejo npm registry; point the updater at it #12

Merged

dsh merged 2 commits from feat/ci-publish into master

2026-10-23 18:27:36 +00:00

dsh commented

2026-10-23 18:27:31 +00:00

Owner

One feature branch for the new release path and the updater repoint.

What changed

Own updater: lib/plugin-updater.js now reads the Forgejo registry packument's dist-tags.latest (Forgejo 17 does not serve npmjs's /latest alias), resolves the credential-backed token per request, and installs through a throwaway scoped .npmrc. That keeps @goodandready on https://git.pvlb.dev/api/packages/dsh-plugins/npm/ while runtime deps and DSH peers still come from npmjs. The user's ~/.npmrc is carried into the temp config so supply-chain settings survive.
CI: .forgejo/workflows/ci.yml runs npm run check and npm pack --dry-run on every push to master. No pull_request trigger: the shared runner exposes the host Docker socket.
Publish: .forgejo/workflows/publish.yml runs on v* tags, requires the tag to equal v<package.json version>, and publishes to the Forgejo npm registry with NPM_TOKEN (already added, write:package). Duplicate versions are skipped; manual runs are dry runs.
Translations dropped: README.ru.md / README.zh.md removed from the tree, package.json#files, and the leak scan. README.md is the single README.
Docs/release: README/AGENTS document CI, publishing, install-from-registry and the updater; version 0.7.40-dsh.3 and CHANGELOG entry.

Verification

npm run check: 37 tests pass, leak scan clean, node --check clean.
npm pack --dry-run: 95 files, 170.6 kB, version 0.7.40-dsh.3; no translations/tests in the tarball.
Live registry checks: throwaway @goodandready/dsh-gitea-ci-probe@0.0.0 published and was deleted via the API; latestVersion('dsh-resend-mcp') against the real registry returned 0.1.2; packument auth with Authorization: token … works.
NPM_TOKEN Actions secret exists.

Fixes #2 #5 #7 were already delivered in #11; this PR is the release/update path.

One feature branch for the new release path and the updater repoint. ## What changed - **Own updater**: `lib/plugin-updater.js` now reads the Forgejo registry packument's `dist-tags.latest` (Forgejo 17 does **not** serve npmjs's `/latest` alias), resolves the credential-backed token per request, and installs through a throwaway scoped `.npmrc`. That keeps `@goodandready` on `https://git.pvlb.dev/api/packages/dsh-plugins/npm/` while runtime deps and DSH peers still come from npmjs. The user's `~/.npmrc` is carried into the temp config so supply-chain settings survive. - **CI**: `.forgejo/workflows/ci.yml` runs `npm run check` and `npm pack --dry-run` on every push to `master`. No `pull_request` trigger: the shared runner exposes the host Docker socket. - **Publish**: `.forgejo/workflows/publish.yml` runs on `v*` tags, requires the tag to equal `v<package.json version>`, and publishes to the Forgejo npm registry with `NPM_TOKEN` (already added, `write:package`). Duplicate versions are skipped; manual runs are dry runs. - **Translations dropped**: `README.ru.md` / `README.zh.md` removed from the tree, `package.json#files`, and the leak scan. `README.md` is the single README. - **Docs/release**: README/AGENTS document CI, publishing, install-from-registry and the updater; version `0.7.40-dsh.3` and CHANGELOG entry. ## Verification - `npm run check`: **37 tests pass**, leak scan clean, `node --check` clean. - `npm pack --dry-run`: 95 files, 170.6 kB, version `0.7.40-dsh.3`; no translations/tests in the tarball. - Live registry checks: throwaway `@goodandready/dsh-gitea-ci-probe@0.0.0` published and was deleted via the API; `latestVersion('dsh-resend-mcp')` against the real registry returned `0.1.2`; packument auth with `Authorization: token …` works. - `NPM_TOKEN` Actions secret exists. Fixes #2 #5 #7 were already delivered in #11; this PR is the release/update path.

dsh added 2 commits

2026-10-23 18:27:31 +00:00

feat(updater): install from the pvlb.dev Forgejo npm registry b9a85196fe

Repoint the one-click updater away from upstream npmjs:

- read the registry packument's dist-tags.latest, because Forgejo 17 does
  not serve the npmjs /latest alias
- install the exact version through a throwaway scoped .npmrc that carries
  the user's settings forward and sends auth only to our registry
- resolve the credential-backed registry token per request
- update the settings/UI copy to describe the Forgejo registry

test/plugin-updater.test.mjs covers packument parsing, numeric fork
ordering, caching, auth/userconfig, and getStatus.

chore(release): 0.7.40-dsh.3 — CI publishing, own registry updater

CI / check (push) Successful in 24s

Details

Publish package / publish (push) Failing after 19s

Details

8c489b45e7

- add .forgejo/workflows/ci.yml (push checks) and publish.yml (tag →
  pvlb.dev Forgejo npm registry with NPM_TOKEN, duplicate-skip, no PR
  trigger)
- add the composite `check` script used by both workflows
- drop the maintained README.ru.md / README.zh.md translations and their
  package/leak-scan entries; README.md is the single README
- document the CI/publish/update flow, bump to 0.7.40-dsh.3 and add the
  CHANGELOG entry

dsh merged commit 8c489b45e7 into master

2026-10-23 18:27:36 +00:00

dsh commented

2026-10-23 18:32:17 +00:00

Author

Owner

Follow-up after merge: the first publish run failed with EPRIVATE because npm pkg set private=false stores the string "false" (truthy to npm). Fixed in 95e0879 with npm pkg delete private; the v0.7.40-dsh.3 tag was re-pointed to that commit (the failed run had published nothing).

CI run #51: success.
Publish run #52: success — @goodandready/dsh-gitea@0.7.40-dsh.3 is in the Forgejo registry (dist-tags.latest).
Live updater check: latestVersion('@goodandready/dsh-gitea') returns 0.7.40-dsh.3.

The deployment profile still has updates: false for the link: dev checkout; flip it in Settings → Gitea when you want the in-UI updater active.

Follow-up after merge: the first publish run failed with `EPRIVATE` because `npm pkg set private=false` stores the **string** `"false"` (truthy to npm). Fixed in 95e0879 with `npm pkg delete private`; the `v0.7.40-dsh.3` tag was re-pointed to that commit (the failed run had published nothing). - CI run #51: success. - Publish run #52: success — `@goodandready/dsh-gitea@0.7.40-dsh.3` is in the Forgejo registry (`dist-tags.latest`). - Live updater check: `latestVersion('@goodandready/dsh-gitea')` returns `0.7.40-dsh.3`. The deployment profile still has `updates: false` for the `link:` dev checkout; flip it in Settings → Gitea when you want the in-UI updater active.

dsh referenced this pull request

2026-10-24 00:59:01 +00:00

fix(ci): gitea_ci status/jobs/run print raw JSON or a bare job name instead of run status #26

dsh referenced this pull request

2026-10-24 00:59:02 +00:00

fix(release): gitea_release_plan ignores current_version's tag and includes already-released commits #28