Skip to content

publishing.md

Latest commit

 

History

History
81 lines (63 loc) · 3.69 KB

publishing.md

File metadata and controls

81 lines (63 loc) · 3.69 KB
Raw

Publication Runbook

Package and registry publication requires owner-controlled accounts and trusted-publisher configuration. The repository workflows do not publish on ordinary pushes.

npm

  1. Create or confirm the public npm organization/scope @theneuralledger.
  2. If version 0.1.0 does not exist yet, qualify the tagged source and publish @theneuralledger/sdk, @theneuralledger/research, @theneuralledger/mcp, then @theneuralledger/cli once from an owner-authenticated terminal with --access public --provenance=false. Trusted publishing cannot be attached until each package record exists.
  3. In npm, create a trusted publisher separately for all four packages using GitHub repository bekirdag/tnl-intelligence, workflow release-npm.yml, environment npm, and allowed action npm publish.
  4. Create the protected GitHub environment npm and require an owner approval.
  5. For later versions, run the Release npm packages workflow manually with the exact package version. It validates and publishes SDK, Research, MCP, then CLI with provenance.

PyPI

Version 0.1.0 is public at pypi.org/project/tnl-intelligence. The active trusted publisher uses owner bekirdag, repository tnl-intelligence, workflow release-python.yml, and protected environment pypi. No PyPI API token is stored.

For later versions:

  1. Update the package version and qualify the exact release source with Ruff, strict mypy, pytest, wheel/sdist build, twine check, and clean installation.
  2. Push the qualified release commit to main.
  3. Run the Release Python package workflow with the exact package version and approve the protected pypi environment.
  4. Verify PyPI hashes, provenance, metadata, SDK import, and tnl-quant from a new no-cache environment.

MCP Registry

The registry name is com.theneuralledger/intelligence, so theneuralledger.com must authorize it.

  1. Generate an Ed25519 key outside the repository: openssl genpkey -algorithm Ed25519 -out key.pem.
  2. Derive the public key: openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64.
  3. Add a TXT record at theneuralledger.com: v=MCPv1; k=ed25519; p=PUBLIC_KEY.
  4. Extract the private hex value using the command in the official MCP Registry DNS-login guide.
  5. Store it as the MCP_DNS_PRIVATE_KEY GitHub environment secret in protected environment mcp-registry.
  6. Publish npm first, then run Release MCP Registry metadata with confirmation 0.1.0.

server.json advertises only the npm stdio package. Add a remote URL only after a TLS and OAuth protected TNL-hosted MCP endpoint is deployed and tested.

Container

The Release container workflow publishes ghcr.io/bekirdag/tnl-intelligence. Run it manually only after the release commit is on main, the clean candidate passes aggregate qualification, and the matching version tag exists. GitHub's package permissions control visibility; no credentials beyond GITHUB_TOKEN are embedded in the image.

For 0.1.0:

  1. Dispatch release-container.yml with version 0.1.0 from the qualified commit.
  2. Wait for the workflow to complete and record its run URL.
  3. Confirm GHCR exposes both 0.1.0 and latest for the same digest and make the package public when necessary.
  4. Pull the versioned image and verify /healthz plus unauthenticated request rejection before announcing the release.

Rollback keeps immutable version evidence and moves or removes only latest until a validated patch image is available.

Local Release Checks

npm ci
npm run validate
npm run pack:check
.venv/bin/python -m build python/tnl_intelligence
docker build -t tnl-intelligence:local .