docs: CONTRIBUTING §Publishing describes what this repo actually does

[huangyiirene]

Fixes #1741

CONTRIBUTING.md §Publishing only. Refs #1503 (where it was found) and #1600 / PR #1736 (which rewrote the page this now links to) — neither is addressed here and both remain open or closed on their own terms.

What was wrong

The section handed a maintainer pnpm release and described it as running pnpm build && changeset publish to "publish each non-private package". Re-derived on this branch, ⛔ inheriting nothing from the card:

CONTRIBUTING.md   'pnpm release'                    1
CONTRIBUTING.md   'non-private package'             1
package.json      scripts.release                   ABSENT
                  publish-shaped keys               ['publish:marketplace', 'publish:marketplace:dry-run']
package.json      private                           True      workspaces: none
pnpm-workspace.yaml                                 does not exist
CONTROL           'pnpm' in CONTRIBUTING.md         18   ⇒ the counts above are real, not a dead grep

changeset publish really does name an empty set — verified, not taken on the card's word

Against the installed pin @changesets/cli@3.0.2, side-effect-free (⛔ no publish was attempted):

• @manypkg/get-packages on this root reports tool: root, one package — hotcrm, private: true.
• dist/getPublishPlan.mjs getUnpublishedPackages filters packages.packages.filter((pkg) => !pkg.packageJson.private && !shouldSkipPackage(pkg, options)) ⇒ [].
• the tag-only leg is config.privatePackages.tag ? getUntaggedPrivatePackages(…) : [], and .changeset/config.json sets privatePackages: { version: true, tag: false } ⇒ [].
• if (releases.length === 0 && tagReleases.length === 0) return [];

So the card's second finding holds, and the section can state it as fact rather than hedge.

What it says now

Nothing here is published to an npm registry; the app ships to the ObjectStack marketplace; pnpm publish:marketplace:dry-run / pnpm publish:marketplace are handed over directly. The correct answer was already in this section's own > note three lines below the wrong command — this promotes it to the body rather than inventing content.

Cross-link, not merge — the grading's Zone 3 lean, confirmed after reading both documents. docs/RELEASE_STRATEGY.md is now 110 lines and already carries the whole runbook: version sources, the five-step checklist through pnpm changeset:version / pnpm build / pnpm publish:marketplace, the objectstack.config.ts manifest version changeset version does not touch, and §Source Availability, which is a correct current-shape replacement for the very paragraph deleted below. Restating any of that in CONTRIBUTING.md would rebuild the second copy that drifted into this card. The section therefore links it as the single source of truth and stops.

⛔ Deliberately not copied across: docs/RELEASE_STRATEGY.md §Marketplace Publish's "Authenticate once: objectstack cloud login". See 验收备注 — that line looks wrong, and propagating it would repeat exactly the failure this card is about.

The retired multi-package shape, handled in the same pass

Three claims went, all measured false against this tree, not merely stale-looking:

removed	measurement
"Only the compiled dist/ folder is included … (controlled by the files field in each package.json)"	root package.json has no files key
"Source code (.ts files) is never published"	main and exports both point at ./objectstack.config.ts — a .ts file is the package entry
"Packages are published to a private GitHub Packages registry (https://npm.pkg.github.com) with restricted access"	that host had 1 occurrence in the whole tree — this very line. No publishConfig, and .npmrc names no registry. The real path is scripts/publish-marketplace.mjs, which POSTs dist/objectstack.json to the cloud control plane

The third was not named in the card's scope list. It is the same defect class as the two that were, it sits inside the block being rewritten, and it is the plural-"Packages" voice of the same retired shape — so leaving it behind would have been leaving the section false.

⛔ No guard added

Per the standing ruling: AGENTS.md Scope rule 3 routes drift-class gates upstream, and #1755 just proved an existing guard here sat vacuous for months. ⛔ package.json was not touched, and no release script was added.

Gates

pnpm verify — exit 0, captured before any pipe (pnpm verify > log 2>&1; EXIT=$?).

✓ Validation passed (1235ms)
✓ i18n lint gate: 0 `i18n/missing-*` issues
✓ source hygiene clean
✓ source token ratchet clean
Test Files  164 passed (164)
     Tests  3438 passed | 1 skipped (3439)

line_budget: NOT APPLICABLE, cited from the gate's own output line rather than asserted:

Source token ratchet — authored surface: src/**/*.ts minus src/translations, src/data

This diff touches 0 .ts files, so it is outside that surface entirely; all three ceilings are byte-identical to base.

Two greens here are genuinely informative rather than vacuous:

• source hygiene prints the surface it read — control bytes : those 398, plus 544 under content, .changeset, docs, .github, .claude and 15 root file(s). CONTRIBUTING.md is one of those 15 (ROOT_TEXT_FILES in scripts/lib/source-hygiene-surface.mjs) and the new changeset is among the 544, so ✓ no raw control bytes in first-party files actually covers both files this PR touches. Independently self-scanned: grep -naP '[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]' on both, no hits.
• Link Check scans .md exact with check-modified-files-only: yes, so unlike an .mdx diff it will really open CONTRIBUTING.md. The one link added — [docs/RELEASE_STRATEGY.md](docs/RELEASE_STRATEGY.md), replacing bare backticks — is therefore genuinely checked.

Changeset form

Empty-frontmatter changeset, not the skip-changeset label. Both are accepted, and .github/workflows/changeset-check.yml documents the empty form as "the sanctioned 'this PR releases nothing' declaration, on par with the skip-changeset label" — but they are not equivalent in what they leave behind:

• the label makes the whole job if:-skip, so changeset status never runs;
• the empty changeset still satisfies both steps, and leaves the reasoning in the tree.

#1600 / PR #1736 — same class, internal release docs, ships nothing — landed with exactly this form. AGENTS.md's "do not reach for the label to get a red check green" points the same way. This PR ships nothing to HotCRM users: contributor-facing prose, no src/ metadata, and the root package carries no files list that could ship it.

验收备注

Observations from this card's own file surface, ⛔ none filed and ⛔ none fixed here.

• ⚠️ docs/RELEASE_STRATEGY.md §Marketplace Publish looks copy-and-it-fails. It says "Authenticate once: objectstack cloud login" and then "Then publish: pnpm publish:marketplace". But scripts/publish-marketplace.mjs takes credentials only from OS_CLOUD_URL / OS_CLOUD_API_KEY in the environment and die()s without them (OS_CLOUD_URL is required); it reads no credential file and never mentions a login session. A maintainer following those two lines in order gets a hard failure. That is a class-(a) defect in a file this card holds read-only, so it is reported, not fixed. ⛔ Not filed as a card, and the reason is a real limitation rather than a judgement call: issue text search is dead in this container. repo:objectstack-ai/hotcrm is:issue is:open CONTRIBUTING returned 0 — a control that must match this very card, whose title contains the word — while repo:objectstack-ai/hotcrm state:open returned 75. So the channel works and term matching does not, and I cannot run the dedupe search a new card requires. ⇒ handed to the PM to file. (REST was tried first and is blocked in this container; the MCP switch is declared.)
• .changeset/config.json still sets "access": "restricted", an npm-publish setting that is now inert, since nothing in this repo publishes through changesets. Cosmetic, no reader is misled, ⛔ not worth a card.承接者:无.

维护者速读

⛔ Not required — CONTRIBUTING.md is not in this repo's governed set (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md), so this takes the normal landing path.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PpRjGNnwyo2J1rrmekxB1W

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
hotcrm	Ignored		Sep 8, 2026 11:13am UTC