fix: publish public releases from target package#28
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Review response — PR #28Verified and fixed the GitHub Advanced Security finding that the CI workflow did not constrain Issues addressed (pushed to this PR)
Review claims verified false (no change needed)
Not addressed here
|
|
CI dependency note for commit
|
|
Codex submission audit update: Current official submission guidance requires every positive case to include reproducible test-account or fixture data. The prior reviewer pack referenced nonexistent Commit
No fixture repository was created. That external org-level action needs an owner decision before portal submission. |
|
Follow-up: the OpenCode public-package E2E rerun is now green after the versioned sandbox resource became available. All eight PR checks pass, and both GitHub Advanced Security threads remain fixed and resolved. The later CORS/image-size review output was generated from the unrelated |
|
Canonical MCP update ( |
|
Skills release dependency is complete:
The remaining merge prerequisite is aictrl-dev/aictrl#3905 deployment plus the exact six-tool production scan at |
|
Codex fixture dependency update:
Commit |
|
Production MCP merge prerequisite is now proven at commit
The remaining release-runbook stop condition is the connected reviewer-fixture rehearsal and publication-owner steps; this evidence does not mark those as complete. |
|
Submission-readiness evidence is now current at
The connected reviewer-fixture rehearsal and publication-owner steps remain explicit stop conditions; this commit does not mark them complete. |
|
Submission hardening is green at
Follow-up source and ancestry checks confirm strict OAuth registered-client, redirect, resource, token-family, and replay protections are already deployed in production main |
|
Latest head
Release stop conditions remain intentionally open: independent approval and merge of the reviewer fixture rehearsal, clean connected-client OAuth evidence, and the authenticated npm/OpenAI publication steps. This PR should not be merged past those gates yet. |
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. 🤖 Generated with Claude Code - If this code review was useful, please react with 👍. Otherwise, react with 👎. |
2 participants
No linked issue in this repository; supports aictrl-dev/aictrl#3865, aictrl-dev/aictrl#3866, and aictrl-dev/aictrl#3882.
Merge and release prerequisites
The runtime and package-source prerequisites are complete. Keep the connected
reviewer rehearsal and publication-owner steps as release stop conditions:
aictrl-dev/skillsv1.0.1 is published at immutable commit01cf2fa9b9bcf3b3b48cb00f3e48764c292ecf18;public-skills.lock.jsonpins that commit and checksum, and all three vendor packages are assembled.
authenticated production scan at
https://aictrl.dev/mcpverifies exactlythe six lifecycle tools, their schemas, safety annotations, descriptions,
and absence of custom-UI metadata.
provides its domain token, the release owner can apply the temporary Cloud
Run override and verify the well-known challenge without committing or
persisting the value.
workflow, provision the fixture-only AICtrl connection and no-MFA reviewer
account, and complete the connected exact-revision rehearsal.
@aictrl/opencodefrom the mergedrelease commit, configure its trusted publisher, and complete the OpenAI
submission, approval, explicit publication, and clean-directory smoke.
Summary
The
public-v0.1.0-beta.1release ran the rootnpm publish, so it attempted to republish@aictrl/plugin@2.2.1and never created@aictrl/opencode.This change:
public-v*releases to./opencodewith thebetadist-tagv*releases routed to the root package withlatest0.1.0-beta.2and fails CI on version driftaictrl, athttps://aictrl.dev/mcpGITHUB_TOKENpermissions tocontents: readFirst-publish prerequisite
npm trusted publishers are package-specific and
@aictrl/opencodedoes not yet exist. After this PR merges, an authenticated@aictrlnpm owner must bootstrap0.1.0-beta.2directly from the merged./opencodepackage using public access and thebetadist-tag. Then configureaictrl-dev/aictrl-plugin/publish.yml/ environmentreleaseas the package trusted publisher and publish the matchingpublic-v0.1.0-beta.2GitHub release from that same commit. The workflow skips the duplicate npm publish only when registry integrity matches the local package exactly; a mismatch fails closed. Laterpublic-v*releases use OIDC with automatic provenance.Test plan
https://aictrl.dev/mcpactionlint .github/workflows/publish.ymlandgit diff --checknpm auditandnpm audit --omit=devreport zero vulnerabilitiesnpm pack ./opencode --dry-run --jsoncontains the expected package payloadaictrl-dev/skillsv1.0.1 checksum verified and all three vendor packages reassembleddevcontribution templatesmaind0d972c/mcpLocal validation on
e586e57passes all 147 tests, the TypeScript build, public-package assembly, submission-listing alignment, and diff checks. The release runbook enforces production exact-six-tool verification before plugin merge. Acquisition remains in the existing web/PostHog path; MCP behavior events use generic lifecycle names andsource: mcprather than encoding package attribution into the server URL.Supports aictrl-dev/aictrl#3865, aictrl-dev/aictrl#3866, aictrl-dev/aictrl#3882, and milestone aictrl-dev/aictrl#63.