publish the editor surface to public npm via trusted publishing - #11
Conversation
Merge PR2 provenance and reproducible packaging baseline for CodePress issue #5319.
feat: publish host-backed FreeCut editor surface
* add caption command and editor ui * fix(editor): mount caption editor in production shell * feat(editor): route captions through host surface * fix(editor): preserve caption background opacity
…hots Applying a transcript edit installs the authoritative snapshot, and the host runtime reset the active sidebar tab to Media on every install. That unmounted the transcript panel before it could show its applied state or its inline revision-conflict error (the conflict only reached the user through the host notify channel). Preserve the active tab when host mode still shows it (media always, text/transcript per capability and port), and keep resetting tabs host mode does not expose. Cover the applied and conflict outcomes through the real MediaSidebar path.
the package is MIT and built from a public repo, so routing it through a private registry only bought a credential every consumer had to obtain. 0.3.0 is already on npmjs.org with the same bytes it had on github packages. - publishConfig targets registry.npmjs.org with public access, and the packaging guard now enforces that instead of the opposite - the release workflow authenticates with OIDC (id-token: write) rather than a GITHUB_TOKEN with packages: write, so there is no token to rotate, and publishes with --provenance - it also runs on merges into the codepress integration branch, not just on release tags, and no-ops when the version is already published - sync-upstream keeps main a clean mirror of walterlow/freecut and warns when the integration branch falls behind - README drops the registry and token setup consumers no longer need
the integration branch could not be named codepress: refs/heads/codepress/ is already a directory in the ref namespace (PR #10's bootstrap branch), so git rejects a ref at refs/heads/codepress outright.
|
Starting initial review of |
![codepress-reviewer-dev[bot]](https://avatars.githubusercontent.com/in/3963614?s=60&v=4){kind=small}
There was a problem hiding this comment.
The package boundary and workflow shape are appropriate: the artifact is built deterministically, tested as an installed consumer, and then published through GitHub OIDC without a long-lived token.
I cannot approve the release migration yet because its required npm-side trusted-publisher configuration has not been verified. The workflow only has an OIDC credential, so a missing or mismatched package configuration will make the next publish fail rather than fall back to a token. Before merging, confirm the publisher for @quantfive/freecut-editor-surface exactly targets quantfive/freecut and publish-editor-surface.yml, and that it allows npm publish; then exercise that path with a safe new version or attach the configuration evidence. npm documents the exact filename/repository match and allowed-action requirement in its trusted publishing guide.
One documentation cleanup can follow: the package README still says the package is published to GitHub Packages immediately before stating that it is published to the public npm registry.
Coverage
This review is partial because some textual changes were not fully supplied or inspected. The automation will not submit an approval until those paths are reviewed.
src/features/editor/codepress/adapter.test.ts(patch_too_large)src/features/editor/codepress/adapter.ts(diff_budget_exceeded)src/features/editor/codepress/caption-editor-view.tsx(diff_budget_exceeded)src/features/editor/codepress/caption-editor.test.tsx(diff_budget_exceeded)src/features/editor/codepress/caption-editor.tsx(diff_budget_exceeded)src/features/editor/codepress/caption-validation.test.ts(diff_budget_exceeded)src/features/editor/codepress/caption-validation.ts(diff_budget_exceeded)src/features/editor/codepress/contract.ts(diff_budget_exceeded)src/features/editor/codepress/document.ts(diff_budget_exceeded)src/features/editor/codepress/edit-engine.ts(diff_budget_exceeded)- ... and 56 more pending file(s)
|
Review head |
the rewrite left the old sentence directly above its replacement, so the readme claimed both registries in consecutive lines.
|
Starting new changes review of |
1 participant
Publishes
@quantfive/freecut-editor-surfaceto the public npm registry using npm trusted publishing (OIDC), so consumers need no credential and this repo needs no publish token.0.3.0is already live on npmjs.org — published by hand from the exact tarball that was on GitHub Packages, with onlypublishConfigretargeted. Same bytes, samedisttree digest (3b5f539a…), so the content-hashed chunk names CodePress pins inapps/web/next.config.tscould not shift. This PR makes the repo agree with that reality so the next release doesn't silently go back to the private registry.Why public
The package is MIT and built from a public repository. Routing it through GitHub Packages bought no secrecy — only a
read:packagestoken every consumer had to obtain, which is a real ongoing cost: CodePress had grown ~630 lines of setup scripts, a pnpmfile advisory, a git-hook token fallback, and a failure sentinel purely to distribute it. All of that is now deleted.Worth noting GitHub Packages' npm registry requires a token even for public packages (
401 {"error":"authentication token not provided"}), so flipping package visibility there would not have helped. npmjs.org was the only option that removes the credential.Changes
publishConfig→registry.npmjs.orgwithaccess: publicscripts/package-editor-surface.mjs— the guard asserted the package must target GitHub Packages and must not be public; it now enforces the opposite. Without this the build fails immediately..github/workflows/publish-editor-surface.yml—permissions: packages: write→id-token: write,registry-url→ npmjs, and the publish step dropsNODE_AUTH_TOKENfor OIDC +--provenance. Also triggers on merges intocodepress-main, not only release tags, and no-ops when the version is already published so a merge without a version bump isn't a red run. Everything else — tag/version matching,verify:provenance, the consumer smoke test against the packed artifact — is untouched..github/workflows/sync-upstream.yml(new) — keepsmaina clean mirror ofwalterlow/freecutviagh repo sync, and warns whencodepress-mainfalls behind.packages/freecut-editor/README.md— drops the registry and token setup consumers no longer need.Fork layout this assumes
mainstays a pristine mirror of upstream; nothing of ours lands there, which is what keepsgh repo synca conflict-free fast-forward.codepress-mainis the integration branch and is now the repo default. Upstream reaches us through a reviewed PR (main→codepress-main) rather than landing unattended.The branch could not be named
codepress:refs/heads/codepress/bootstrap/dev-server/…(PR #10) already occupies that namespace as a directory, so git rejects a ref atrefs/heads/codepress.Read this before merging
20 of the 22 commits here are the
pr9d-freecut-transcript-consumer-5319line, not this change. Only the last two are mine.codepress-mainwas seeded frommain, so it has nopackages/freecut-editorat all — this PR is the first thing to bring the surface package onto the integration branch, and it brings that entire feature line with it.The 5319 branches diverge.
pr9dvsqa/parity-gates-5319is 4 ahead / 2 behind, andpr9a-caption-ui-5319diverges from both. Merging this integrates thepr9dline only; the other two are not included and will need their own integration. Ifpr9dis not the line you want as the basis, say so and I'll rebase onto whichever is.Not verified here
I could not exercise the workflow. Two things need checking on the first real run: the trusted publisher must be configured on npmjs.com against this repository and the filename
publish-editor-surface.yml(renaming the file breaks publishing until that entry is updated), and--provenancemay reject a pre-built tarball rather than a live pack — if it does, dropping the flag is the fix and OIDC auth is unaffected.