Skip to content

docs: record npm package bootstrap #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kestiny18 merged 1 commit into from
Aug 15, 2026
Merged

docs: record npm package bootstrap #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,3 +17,13 @@ This repository is a pnpm workspace for independently published DeepSeek Harness
- CI must use least-privilege permissions and a frozen lockfile.
- npm releases must use Trusted Publishing (OIDC); never commit or add a long-lived npm token to GitHub Secrets.
- Each plugin owns its README, LICENSE, changelog, source, and tests. Contribution, security, CI, and publishing policy live at the root.

## New npm package bootstrap

- Before creating the first GitHub Release for a new package, verify whether the package already exists on npm and is owned by the expected maintainer.
- npm Trusted Publishers are configured per existing package. A brand-new package cannot complete its first publication through OIDC alone because its npm settings do not exist yet.
- Bootstrap a new package once from an owner-controlled machine using interactive/web npm authentication and an isolated temporary user config. Never store that credential in this repository or in GitHub Secrets.
- Use a minimal `0.0.0` placeholder and publish it with the `bootstrap` dist-tag. npm may still create `latest: 0.0.0` for the first version; treat that as temporary and verify the real release replaces `latest`.
- After bootstrap, configure the package's npm Trusted Publisher for GitHub Actions with repository `kestiny18/dsh-plugins`, workflow filename `publish.yml`, environment `npm`, and only the required publish action.
- Publish the first real version only through the existing GitHub Release workflow. Completion requires a successful publish job and an npm registry check showing the intended version and `latest` dist-tag.
- After the real release is verified, deprecate the `0.0.0` placeholder and remove the `bootstrap` dist-tag when practical.