Repository navigation
Plan 001: tick A6; publish job runs in the npm environment - #48
Merged
jallers merged 3 commits intoNov 7, 2026
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016NSWj9gL1oCubj5e2anVkb
The environment carries the approval rule (a required reviewer, v* tags only), and npm's trusted-publisher link will name it, so only an approved run in that environment can publish. README: Releasing says so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016NSWj9gL1oCubj5e2anVkb
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016NSWj9gL1oCubj5e2anVkb
jallers
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This ticks A6 and gates publishing behind a GitHub environment.
@versionone/agility-sdk@1.0.0-alpha.0is on npmjs under the MIT license, on thealphadist-tag, and onlatest, which npm sets on a package's first publish. It was published by hand, so it has no provenance. That leaves agility-rooms (D1–D4) as the only open part of plan 001.npm, which holds the approval rule (a required reviewer,v*tags only). The npmjs trusted-publisher link will name this environment, so only an approved run can publish. The README's "Releasing" section and the workflow comments say so.Order matters:
npmenvironment in this repo's settings.versionone, repositoryVersionOne.SDK.JavaScript, workflowpublish.yml, environmentnpm.🤖 Generated with Claude Code
https://claude.ai/code/session_016NSWj9gL1oCubj5e2anVkb