From f6ff46165ea41065d40e4e61cd62bef7b932a92b Mon Sep 17 00:00:00 2001 From: FireXCore Date: Tue, 3 Nov 2026 20:03:05 +0330 Subject: [PATCH] docs(ci): record public npm v0.2.0 release and allow registry processing time --- .github/workflows/publish-npmjs.yml | 20 ++++++++++++++------ CHANGELOG.md | 2 +- README.md | 18 ++++++++++++------ docs/PUBLIC_NPMJS.md | 8 ++++++-- 4 files changed, 33 insertions(+), 15 deletions(-) diff --git a/.github/workflows/publish-npmjs.yml b/.github/workflows/publish-npmjs.yml index e5627df..9973a5a 100644 --- a/.github/workflows/publish-npmjs.yml +++ b/.github/workflows/publish-npmjs.yml @@ -68,13 +68,21 @@ jobs: - name: Confirm public registry metadata run: | set -euo pipefail - for attempt in 1 2 3 4 5; do - if npm view '@firexcore/agent-orbs@0.2.0' version --registry=https://registry.npmjs.org/ 2>/dev/null | grep -Fxq '0.2.0'; then - npm view '@firexcore/agent-orbs@0.2.0' dist.tarball repository.url --registry=https://registry.npmjs.org/ - echo 'PUBLIC_NPMJS_VERIFIED' + url='https://registry.npmjs.org/%40firexcore%2Fagent-orbs/0.2.0' + # npm may return success while its public metadata is still processing. + for attempt in $(seq 1 36); do + http="$(curl --silent --show-error --location --max-time 12 --output /tmp/agent-orbs-public.json --write-out '%{http_code}' "$url" || true)" + if [[ "$http" == '200' ]] && node - <<'NODE' + const p=require('/tmp/agent-orbs-public.json'); + const repo=typeof p.repository==='string'?p.repository:p.repository?.url||''; + if(p.name!=='@firexcore/agent-orbs'||p.version!=='0.2.0'||!p.dist?.tarball?.startsWith('https://registry.npmjs.org/')||!repo.includes('github.com/FireXCore/agent-orbs'))process.exit(1); + console.log('PUBLIC_NPMJS_VERIFIED',p.name,p.version,p.dist.tarball); + NODE + then exit 0 fi - sleep 3 + echo "Public registry processing: HTTP $http, attempt $attempt / 36" + sleep 10 done - echo 'Registry verification failed' >&2 + echo 'Public npm registry metadata did not become available' >&2 exit 1 diff --git a/CHANGELOG.md b/CHANGELOG.md index 35efe7c..44dd2e5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ - Provides pointer/touch interaction, light/dark themes, animation speed, pause and reduced-motion handling. - Includes the production demo, source documentation, geometry and compatibility tests. - Retains the upstream license and attribution in `third_party/thinking-orbs/`. -- Publishes a GitHub Packages npm installable package and release tarball. Publishing to npmjs.org remains separate. +- Published to **npmjs.org** as public `@firexcore/agent-orbs@0.2.0`, as well as GitHub Packages and the GitHub Release tarball. Public registry visibility verified. ## v0.1.0 — Initial public library diff --git a/README.md b/README.md index 5db67af..b859311 100644 --- a/README.md +++ b/README.md @@ -176,21 +176,27 @@ Make the selected `state` reflect an actual action: for example, only display `l ## Releases -- **Latest release:** [v0.1.0](https://github.com/FireXCore/agent-orbs/releases/tag/v0.2.0) +- **Latest release:** [v0.2.0](https://github.com/FireXCore/agent-orbs/releases/tag/v0.2.0) - **Downloadable distributable:** [firexcore-agent-orbs-0.2.0.tgz](https://github.com/FireXCore/agent-orbs/releases/download/v0.2.0/firexcore-agent-orbs-0.2.0.tgz) - **Changelog:** [CHANGELOG.md](CHANGELOG.md) - **Interactive demo:** [agent-orbs-demo.vercel.app](https://agent-orbs-demo.vercel.app/) -The v0.2.0 tarball is attached to the GitHub Release. The library is published as **`@firexcore/agent-orbs@0.2.0`** on the [GitHub Packages npm registry](https://npm.pkg.github.com/) (not npmjs.org). GitHub Packages requires authenticated npm access; visibility is controlled in the GitHub Packages settings. The npmjs.org registry is a separate publication channel. - -To install with GitHub Packages authorization already configured (a GitHub token with package read permission may be required): +**Public npmjs.org:** [@firexcore/agent-orbs@0.2.0](https://www.npmjs.com/package/@firexcore/agent-orbs) — confirmed in the public npm registry. Install without any GitHub Packages authentication: ```bash -npm config set @firexcore:registry https://npm.pkg.github.com npm install @firexcore/agent-orbs@0.2.0 ``` -See [GitHub's npm registry authentication guide](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-npm-registry). +If you previously configured `@firexcore` to use GitHub Packages, remove the old registry override before installing from npmjs.org: + +```bash +npm config delete @firexcore:registry +npm install @firexcore/agent-orbs@0.2.0 --registry=https://registry.npmjs.org/ +``` + +The GitHub release [v0.2.0](https://github.com/FireXCore/agent-orbs/releases/tag/v0.2.0) also provides the downloadable `.tgz`. The same version remains available separately through GitHub Packages for authenticated users. + +**Provenance note:** The initial public npmjs release was published without Sigstore provenance because duplicate transparency-log entry `TLOG_CREATE_ENTRY_ERROR (409)` blocked earlier publish attempts. Future releases should restore provenance using npm Trusted Publishing (OIDC) after resolving the upstream signing issue. CI and package build tests passed, and independent public-registry metadata verification succeeded. ## Attribution diff --git a/docs/PUBLIC_NPMJS.md b/docs/PUBLIC_NPMJS.md index fcb82d1..b080955 100644 --- a/docs/PUBLIC_NPMJS.md +++ b/docs/PUBLIC_NPMJS.md @@ -2,7 +2,7 @@ GitHub Packages (`npm.pkg.github.com`) and the public npm registry (`registry.npmjs.org`) are separate. The repository's source version is `@firexcore/agent-orbs@0.2.0`; publishing there requires control of the `@firexcore` npmjs scope. -The publish workflow is `.github/workflows/publish-npmjs.yml`. It checks the package/version and source repository, builds, runs tests, confirms required ESM/CJS exports and upstream license notices, runs `npm pack --dry-run`, and publishes with `--access public --provenance`. It verifies public registry metadata before reporting success. It does not modify the GitHub Packages release. +The publish workflow is `.github/workflows/publish-npmjs.yml`. It checks the package/version and source repository, builds, runs tests, confirms required ESM/CJS exports and upstream license notices, runs `npm pack --dry-run`, and publishes with `--access public`. For the initial 0.2.0 release, provenance is temporarily disabled in the workflow because a duplicate Sigstore transparency-log entry returned 409. It verifies public registry metadata with delayed polling before reporting success. It does not modify the GitHub Packages release. ## Authentication @@ -22,7 +22,9 @@ Once authenticated, a push changing the workflow on `main` runs the publish auto ## Status and verification -The GitHub Actions run must finish successfully and emit `PUBLIC_NPMJS_VERIFIED`. Independently verify at https://www.npmjs.com/package/@firexcore/agent-orbs and by using: +**Published:** `@firexcore/agent-orbs@0.2.0` is available on the public npm registry. The independent [registry verification job](https://github.com/FireXCore/agent-orbs/actions/runs/41674994651) emitted `PUBLIC_NPMJS_VERIFIED` after npm completed indexing. The initial publish workflow returned a false failure because its original 15-second verification window was shorter than npm's metadata processing delay. The verification window is now extended to 6 minutes. + +Independently verify at https://www.npmjs.com/package/@firexcore/agent-orbs and by using: ```bash npm view @firexcore/agent-orbs@0.2.0 version --registry=https://registry.npmjs.org/ @@ -30,3 +32,5 @@ npm install @firexcore/agent-orbs@0.2.0 --registry=https://registry.npmjs.org/ ``` Do not claim npmjs publication solely because GitHub CI, GitHub Packages or Vercel succeeded. + +For subsequent releases, move from long-lived `NPM_TOKEN` to npm Trusted Publishing and restore provenance after confirming the Sigstore duplicate-entry issue is resolved. Token revocation should follow a tested OIDC transition.