From 96b779489870b52447ae2edf53dd6b9fbe197d45 Mon Sep 17 00:00:00 2001 From: localhost41 Date: Thu, 9 Jul 2026 23:38:09 -0700 Subject: [PATCH] Harden production readiness gates --- .github/workflows/publish-alpha.yml | 38 +++++++++++++++++++++++++++++ docs/validation-checklist.md | 15 ++++++------ package.json | 11 +++++++++ 3 files changed, 57 insertions(+), 7 deletions(-) create mode 100644 .github/workflows/publish-alpha.yml diff --git a/.github/workflows/publish-alpha.yml b/.github/workflows/publish-alpha.yml new file mode 100644 index 0000000..0dc1c3f --- /dev/null +++ b/.github/workflows/publish-alpha.yml @@ -0,0 +1,38 @@ +name: Publish Alpha + +on: + workflow_dispatch: + inputs: + ref: + description: Git ref or tag to publish + required: true + default: main + +permissions: + contents: read + id-token: write + +jobs: + publish: + runs-on: ubuntu-latest + environment: npm-publish + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ inputs.ref }} + - uses: pnpm/action-setup@v4 + with: + version: 11.10.0 + - uses: actions/setup-node@v4 + with: + node-version: 22 + cache: pnpm + registry-url: https://registry.npmjs.org + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Verify alpha package + run: | + node -e "const p=require('./package.json'); if (!/-alpha\\./.test(p.version)) throw new Error('Refusing to publish non-alpha version ' + p.version);" + pnpm verify:package + - name: Publish alpha + run: npm publish --access public --tag alpha --provenance diff --git a/docs/validation-checklist.md b/docs/validation-checklist.md index 1bdc0f4..296c438 100644 --- a/docs/validation-checklist.md +++ b/docs/validation-checklist.md @@ -16,18 +16,18 @@ all automated tests use in‑memory mock servers. Current package version: `0.1.0-alpha.0` -As of 2026-07-09: +As of 2026-07-10: - Automated mock validation: covered by `pnpm verify:package` and CI on Node.js 22, 24, and 26. Record the exact CI run before release. - Packed package installability: covered by `pnpm verify:package`, which packs the tarball, installs it into a temporary consumer project, imports the public API, runs the installed CLI help command, and checks shipped docs. -- Real-QVAC validation: **[UNRESOLVED]**. No passing live-QVAC run is claimed by - this repository until the matrix in [Real QVAC Validation](#2-real-qvac-validation) - includes dated pass entries with endpoint, model, command, and notes. -- Public benchmark claims: **blocked** until real-QVAC validation is completed - and a benchmark report is filled from `docs/reports/template.md`. +- Real-QVAC alpha smoke validation: passed on macOS with the shared QVAC factory + production E2E gate and local model alias `qvac-local`. +- Public benchmark claims: **blocked** until a benchmark report is filled from + `docs/reports/template.md` with hardware, model, endpoint, prompt, cold/warm + run notes, and exact command output. --- @@ -85,7 +85,8 @@ pipeline that does not have access to the real endpoint. | Environment | QVAC URL | Model | Command (example) | Expected Output | Pass? | Date | Notes | | ------------------------------- | ----------------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | :---: | ---------- | ----- | -| macOS 14 (Apple Silicon) – local | `` | `gpt-4o-mini` | `node dist/cli.js --url $QVAC_URL --model gpt-4o-mini --prompt "Hello" --max-tokens 50 --iterations 3` | Time‑to‑first‑token and total‑time stats printed; exit code 0. | ☐ | | Run after a clean build. **[UNRESOLVED]** | +| macOS 15/26 (Apple Silicon) – local | `http://127.0.0.1:11434/v1/chat/completions` | `qvac-local` | `scripts/qvac-production-e2e.sh --source npm --keep-tmp` from `/Users/samaroomini/qvac-factory` | JSON metrics emitted with `timeToFirstTokenMs`, `totalTimeMs`, `completionTokens`, `tokensPerSecond`, and `output`; exit code 0. | ☑ | 2026-07-10 | Published package validation. Logs: `/tmp/qvac-production-e2e-MUtM0W/bench-live.json`. | +| macOS 15/26 (Apple Silicon) – local | `http://127.0.0.1:11434/v1/chat/completions` | `qvac-local` | `scripts/qvac-production-e2e.sh --source local --keep-tmp` from `/Users/samaroomini/qvac-factory` | JSON metrics emitted with `timeToFirstTokenMs`, `totalTimeMs`, `completionTokens`, `tokensPerSecond`, and `output`; exit code 0. | ☑ | 2026-07-10 | Local packed-artifact validation. Logs: `/tmp/qvac-production-e2e-rWHFvN/bench-live.json`. | | Linux (fresh install) | `` | `gpt-4o-mini` | `node dist/cli.js --url $QVAC_URL --model gpt-4o-mini --prompt "Hello" --max-tokens 50 --iterations 3` | Same as above; no errors. | ☐ | | Node.js 22, 24, or 26 from a clean image. **[UNRESOLVED]** | ### 2.3 Steps for Each Row diff --git a/package.json b/package.json index 5b29a63..2c6b1c2 100644 --- a/package.json +++ b/package.json @@ -3,6 +3,14 @@ "version": "0.1.0-alpha.0", "description": "QVAC developer tooling package: qvac-bench", "license": "MIT", + "repository": { + "type": "git", + "url": "git+https://github.com/localhost41/qvac-bench.git" + }, + "bugs": { + "url": "https://github.com/localhost41/qvac-bench/issues" + }, + "homepage": "https://github.com/localhost41/qvac-bench#readme", "type": "module", "main": "dist/index.js", "types": "dist/index.d.ts", @@ -10,6 +18,9 @@ "qvac-bench": "dist/cli.js" }, "files": ["dist", "docs", "README.md", "CHANGELOG.md", "LICENSE"], + "publishConfig": { + "access": "public" + }, "engines": { "node": ">=22 <27" },