feat(release): resolve @unerp/* from the public npm registry - #1
Merged
Conversation
Phase A01. This repo's .npmrc pointed @unerp at http://localhost:4873/, a self-hosted Verdaccio reachable only from one machine — so no CI runner could resolve @unerp/* at all, and the previous cutover was reverted because every `pnpm install --frozen-lockfile` on a runner resolved the scope against the runner's own localhost. Eighteen repositories carried that line. Not GitHub Packages, and not for preference: it requires the npm scope to equal the account or organisation owning the repository, and these repos are owned by the user `kannan19302` while the packages are @unerp/*. No `unerp` organisation exists, and the `unierp` one that does still would not match. ROADMAP.md had recommended it for its existing OIDC tokens; that was wrong. The public registry is also the better answer on its merits — a self-hoster runs `npm install @unerp/kernel` with no authentication, which is what a claim to be self-hostable in full under AGPL-3.0 actually requires. Where this repo publishes a library, publish.yml declares which gate applies and contains no publish logic. That lives once, in unierp-workspace/.github/workflows/publish-library.yml — the invariant unierp-workspace's README claims to own, and which D019 found was true of nothing in this family. Publishing uses npm trusted publishing, so no long-lived token exists to leak or commit; fourteen were committed once, here and in thirteen sibling repositories at the same time. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Phase A14/D015. This repository either had no agent entrypoint at all, or had one telling every coding agent that the master documents live in ERPSys/docs/ai/ — the retired monorepo. Fifteen such files existed across five repositories, so the first thing any vendor agent read there was an instruction to go somewhere that does not exist, and the other twenty-five repositories gave it no orientation, no layer statement, and no knowledge that a development plan exists. Same defect class as D005: a pointer that outlived its target. AGENTS.md is the emerging cross-vendor convention; CLAUDE.md and GEMINI.md are read automatically by their respective tools and are pointers to it here. All three are generated by unierp-workspace/scripts/sync-agent-entrypoints.mjs, and deliberately short: fifteen hand-maintained copies of the same guidance had already drifted from each other, so one canonical file lives in unierp-workspace/AGENTS.md and every repo gets a pointer plus its own layer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Regenerated by unierp-workspace/scripts/sync-agent-entrypoints.mjs after A30 was added (D024 — main's CI has been red since extraction). Generated, not hand-edited, which is the point: fifteen hand-maintained copies had already drifted from each other. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase A01 —
@unerp/*now resolves from the public npm registry.Why this repo changed
.npmrcpointed@unerpathttp://localhost:4873/, a self-hosted Verdaccio reachable from one machine only. No CI runner could resolve@unerp/*at all — and the previous cutover was reverted because everypnpm install --frozen-lockfileon a runner resolved the scope against the runner’s own localhost. Eighteen repositories carried that line;ROADMAP.mdcalls it "the one thing that blocks the rest".Not GitHub Packages — it cannot host this scope
GitHub Packages requires the npm scope to equal the account or organisation owning the repository. These repos are owned by the user
kannan19302; the packages are@unerp/*. There is nounerporganisation, and theunierpone that does exist still would not match.ROADMAP.mdrecommended GitHub Packages for its existing OIDC tokens — that was wrong, and is corrected there.The public registry is also better on its merits: a self-hoster runs
npm install @unerp/kernelwith no authentication, which is what a claim to be self-hostable in full under AGPL-3.0 actually requires.No token, anywhere
Publishing uses npm trusted publishing — OIDC mints a short-lived credential from the workflow’s own identity, so there is no long-lived secret to leak, rotate, or commit. That matters here specifically: fourteen registry tokens were committed once, in fourteen public repositories at the same time.
Where this repo publishes a library,
publish.ymldeclares which gate applies and contains no publish logic. That lives once, inunierp-workspace/.github/workflows/publish-library.yml— the invariantunierp-workspace’s README claims to own, and which D019 found was true of nothing in this family (grep -l workflow_callreturned zero across all 30 repos).Still outstanding
The
unerpnpm organisation, and a first publish. A01 stays WIP until a clean install resolves — configuration that looks complete is not the same thing.🤖 Generated with Claude Code