soulcraft/brainy
2
0
Fork 0
Code Issues 1 Pull requests Projects Releases 335 Packages Wiki Activity Actions

feat(release): the forge publish leg moves to CI on the tag push; the laptop verifies by readback and keeps the abort-before-storefront guard

Browse source
This commit is contained in:
David Snelling 2026-07-27 11:11:53 -07:00
parent 4d196af41b
commit 3e4a17dcdf
3 changed files with 94 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

45
scripts/release.sh
View file

@ -181,30 +181,33 @@ echo -e "${BLUE}8️⃣ Pushing to origin...${NC}"
git push --follow-tags origin "$CURRENT_BRANCH"
echo -e "${GREEN}✅ Pushed to origin${NC}\n"
# Step 10: Publish — forge FIRST (home), npmjs second (the world's storefront).
# The fleet-wide ~/.npmrc maps the @soulcraft scope to the forge registry, and
# a scope mapping BEATS `--registry` on the command line — so each publish
# names its registry via the scope override explicitly. Nothing implicit.
# Step 10: Forge publish is CI's job now, not the laptop's — a tag push (just
# above) triggers .forgejo/workflows/publish-forge.yml, which builds and
# publishes on the forge's own runner (datacenter-side: seconds, not the
# laptop's WAN timing out on an 87MB tarball PUT). The laptop holds no forge
# publish credential anymore; it only waits for CI's result before trusting
# the forge/npmjs pair enough to publish the storefront leg.
FORGE_NPM_REG="https://source.soulcraft.com/api/packages/soulcraft/npm/"
FORGE_NPM_TOKEN_FILE="$HOME/.config/soulcraft/npm-publish-brainy.token"
echo -e "${BLUE}9️⃣ Publishing to the forge registry (home)...${NC}"
if [ -f "$FORGE_NPM_TOKEN_FILE" ]; then
TMPRC="$(mktemp)"
chmod 600 "$TMPRC"
{
echo "@soulcraft:registry=${FORGE_NPM_REG}"
echo "//source.soulcraft.com/api/packages/soulcraft/npm/:_authToken=$(cat "$FORGE_NPM_TOKEN_FILE")"
} > "$TMPRC"
if npm publish --tag "$NPM_TAG" --userconfig "$TMPRC"; then
echo -e "${GREEN}✅ Published to the forge${NC}\n"
else
rm -f "$TMPRC"
echo -e "${RED}❌ Forge publish FAILED — aborting before npmjs so the pair never diverges. Fix and re-run.${NC}"
exit 1
FORGE_POLL_INTERVAL_S=15
FORGE_POLL_MAX_ATTEMPTS=40 # 40 × 15s = 10 minutes
echo -e "${BLUE}9️⃣ Waiting for CI to publish v${NEW_VERSION} to the forge registry (home)...${NC}"
FORGE_LANDED=false
for ((attempt = 1; attempt <= FORGE_POLL_MAX_ATTEMPTS; attempt++)); do
LANDED_VERSION=$(npm view "@soulcraft/brainy@${NEW_VERSION}" version "--@soulcraft:registry=${FORGE_NPM_REG}" 2>/dev/null || echo "")
if [ "$LANDED_VERSION" = "$NEW_VERSION" ]; then
FORGE_LANDED=true
break
fi
rm -f "$TMPRC"
echo -e "${YELLOW} … not yet on the forge (attempt ${attempt}/${FORGE_POLL_MAX_ATTEMPTS}); retrying in ${FORGE_POLL_INTERVAL_S}s${NC}"
sleep "$FORGE_POLL_INTERVAL_S"
done
if [ "$FORGE_LANDED" = true ]; then
echo -e "${GREEN}✅ CI published v${NEW_VERSION} to the forge${NC}\n"
else
echo -e "${RED}❌ Forge publish token missing (${FORGE_NPM_TOKEN_FILE}) — aborting. The forge is home; publish it first or restage the token.${NC}"
echo -e "${RED}❌ CI forge publish did not land — check the workflow run on The Source; the pair must not diverge.${NC}"
echo -e "${RED} v${NEW_VERSION} was tagged and pushed, but @soulcraft/brainy@${NEW_VERSION} never became visible on the${NC}"
echo -e "${RED} forge registry after ${FORGE_POLL_MAX_ATTEMPTS} attempts, ${FORGE_POLL_INTERVAL_S}s apart. Aborting before npmjs.${NC}"
exit 1
fi