You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
npm publishing for @wavehouse/sdk is live and confirmed working via OIDC trusted publishing (#227, shipped in #266 + #267). This tracks the remaining post-launch / go-public hardening items.
Follow-ups
Enable build provenance.(done in ci: add build provenance for npm, go binaries, and the ghcr image #308 — also extended to Go release binaries + the GHCR image, not just the two npm publish lines.) Once the repo is public (the "Make GitHub repo public" step in release: cut v0.1.0 (first public release) #149), uncomment --provenance on bothnpm publish lines in .github/workflows/publish-npm.yml (the dev and release jobs). Provenance requires a public source repo; it adds a signed SLSA build attestation + the npm "Provenance" badge. Do this together with the go-public step so it isn't forgotten.
Exercise the sdk-v* release path.(done 2026-08-19 — clients/ts/v0.1.0. The prefix was renamed sdk-v* → clients/ts/v* in ci(release): make every version tag-driven and fix the dev channel #485 so Go submodule tagging works. Verified: tag↔version match, dist-tag derivation, npm publish with provenance, and gh release create.) The release job (tag → latest/alpha/beta/rc/next + a GitHub Release) is wired but has never run. Cutting sdk-v0.1.0 (or sdk-v0.1.0-alpha.1) is its first real test — verify the tag↔version match check, dist-tag derivation, npm publish, and gh release create.
latest dist-tag.(done 2026-08-19 — latest now resolves to 0.1.0, off the 0.0.0-dev.0f8826c bootstrap. Confirmed via npm view @wavehouse/sdk dist-tags.) It currently points at the bootstrap 0.0.0-dev.0f8826c (npm auto-set latest on the first-ever publish), so bare npm install @wavehouse/sdk resolves to a dev build. The first sdk-v* release publishes a real version to latest and resolves this — confirm afterward.
Document the npm release flow(mostly done — the release flow, tag families, and the dev channel are documented in development.md → Cutting a release, not AGENTS.md. Not covered there: the one-trusted-publisher constraint and the Node 24 / npm ≥ 11.5.1 requirement, which still live only in publish-npm.yml comments — carried to release: v0.1.0 post-release follow-ups (latest badge, notes, version flag, docs) #501.)in AGENTS.md — the content-addressed dev channel, the sdk-v* release flow, the one-trusted-publisher constraint, and the Node 24 / npm ≥ 11.5 requirement.
How it works today (context)
One trusted publisher: publish-npm.yml (configured on npmjs.com → Wave-RF/WaveHouse). OIDC, no NPM_TOKEN.
npm publishing for
@wavehouse/sdkis live and confirmed working via OIDC trusted publishing (#227, shipped in #266 + #267). This tracks the remaining post-launch / go-public hardening items.Follow-ups
--provenanceon bothnpm publishlines in.github/workflows/publish-npm.yml(thedevandreleasejobs). Provenance requires a public source repo; it adds a signed SLSA build attestation + the npm "Provenance" badge. Do this together with the go-public step so it isn't forgotten.sdk-v*release path. (done 2026-08-19 —clients/ts/v0.1.0. The prefix was renamedsdk-v*→clients/ts/v*in ci(release): make every version tag-driven and fix the dev channel #485 so Go submodule tagging works. Verified: tag↔version match, dist-tag derivation,npm publishwith provenance, andgh release create.) Thereleasejob (tag →latest/alpha/beta/rc/next+ a GitHub Release) is wired but has never run. Cuttingsdk-v0.1.0(orsdk-v0.1.0-alpha.1) is its first real test — verify the tag↔version match check, dist-tag derivation,npm publish, andgh release create.latestdist-tag. (done 2026-08-19 —latestnow resolves to0.1.0, off the0.0.0-dev.0f8826cbootstrap. Confirmed vianpm view @wavehouse/sdk dist-tags.) It currently points at the bootstrap0.0.0-dev.0f8826c(npm auto-setlateston the first-ever publish), so barenpm install @wavehouse/sdkresolves to a dev build. The firstsdk-v*release publishes a real version tolatestand resolves this — confirm afterward.devchannel are documented indevelopment.md→ Cutting a release, not AGENTS.md. Not covered there: the one-trusted-publisher constraint and the Node 24 / npm ≥ 11.5.1 requirement, which still live only inpublish-npm.ymlcomments — carried to release: v0.1.0 post-release follow-ups (latest badge, notes, version flag, docs) #501.)in AGENTS.md— the content-addresseddevchannel, thesdk-v*release flow, the one-trusted-publisher constraint, and the Node 24 / npm ≥ 11.5 requirement.How it works today (context)
publish-npm.yml(configured on npmjs.com →Wave-RF/WaveHouse). OIDC, noNPM_TOKEN.mainbuilds the SDK and publishes to thedevdist-tag, skipping when the package content is unchanged. Commit traceability via npmgitHead. (Superseded by ci(release): make every version tag-driven and fix the dev channel #485: the version is now0.0.1-dev.<utc-stamp>.h<hash>— the old0.0.0-dev.h<hash>form was unordered, so@devcould resolve backwards (npm: the dev channel's versions don't order by recency, so a range resolves to a two-month-old build #475). The hash now covers everythingnpm packships, not justdist/.)Refs #227, #149.