From f4c4c2aaad7cf1c0584d5bcd88751e63e2ffb8da Mon Sep 17 00:00:00 2001 From: Daniil Koryto Date: Mon, 13 Apr 2026 12:03:08 +0300 Subject: [PATCH 1/3] fix: skip alias publish before npm bootstrap --- AGENTS.md | 1 + CHANGELOG.md | 1 + scripts/publish-alias-package.mjs | 45 ++++++++++++++++++++++++++----- 3 files changed, 41 insertions(+), 6 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index dd68863..af77ac9 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -247,6 +247,7 @@ Fallback entrypoints: Alias publishing: - `publish-alias-package.mjs` builds the `@gonkagate/claude-code-setup` alias package from the current root build output +- if that alias package is not visible on npm yet, the script skips alias publishing so the primary `@gonkagate/claude-code` release can complete; bootstrap the alias package and configure Trusted Publishing before requiring alias publish success They must not replace `npx` as the primary public UX. diff --git a/CHANGELOG.md b/CHANGELOG.md index ccf69d3..ca7e481 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Unreleased +- Made alias package publishing skip cleanly until `@gonkagate/claude-code-setup` is bootstrapped on npm. - Added `@gonkagate/claude-code-setup` as a setup-style alias for the existing Claude Code installer. - Improved npm package metadata and README copy for better package-page clarity, discovery, and onboarding. - Added a curated model registry and model picker to the public installer flow. diff --git a/scripts/publish-alias-package.mjs b/scripts/publish-alias-package.mjs index 8ed73b6..50cc787 100644 --- a/scripts/publish-alias-package.mjs +++ b/scripts/publish-alias-package.mjs @@ -8,6 +8,8 @@ import { fileURLToPath } from "node:url"; const ALIAS_PACKAGE_NAME = "@gonkagate/claude-code-setup"; const ALIAS_BIN_NAME = "claude-code-setup"; const dryRun = process.argv.includes("--dry-run"); +const requireExistingPackage = process.argv.includes("--require-package") + || process.env.REQUIRE_ALIAS_PACKAGE === "1"; const scriptDir = dirname(fileURLToPath(import.meta.url)); const repoRoot = resolve(scriptDir, ".."); @@ -28,20 +30,30 @@ function run(command, args, options = {}) { } } -function isPublished(packageName, version) { - const result = spawnSync("npm", ["view", `${packageName}@${version}`, "version"], { +function isNpmNotFound(output) { + return output.includes("E404") || output.includes("404 Not Found"); +} + +function npmView(args) { + const result = spawnSync("npm", ["view", ...args], { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }); if (result.status === 0) { - return true; + return { + exists: true, + output: result.stdout + }; } const output = `${result.stdout}\n${result.stderr}`; - if (output.includes("E404") || output.includes("404 Not Found")) { - return false; + if (isNpmNotFound(output)) { + return { + exists: false, + output + }; } process.stdout.write(result.stdout); @@ -49,6 +61,14 @@ function isPublished(packageName, version) { process.exit(result.status ?? 1); } +function canViewPackage(packageName) { + return npmView([packageName, "name"]).exists; +} + +function isVersionPublished(packageName, version) { + return npmView([`${packageName}@${version}`, "version"]).exists; +} + async function assertExists(path) { await access(path, fsConstants.R_OK); } @@ -56,7 +76,20 @@ async function assertExists(path) { const rootPackage = JSON.parse(await readFile(join(repoRoot, "package.json"), "utf8")); const packageVersion = rootPackage.version; -if (!dryRun && isPublished(ALIAS_PACKAGE_NAME, packageVersion)) { +if (!dryRun && !canViewPackage(ALIAS_PACKAGE_NAME)) { + console.warn(`${ALIAS_PACKAGE_NAME} is not visible on npm yet, or this publisher cannot access it.`); + console.warn(`Bootstrap ${ALIAS_PACKAGE_NAME} on npm and configure Trusted Publishing for this workflow, then rerun npm run publish:alias.`); + + if (requireExistingPackage) { + console.warn("Alias package publishing is required for this run, so failing now."); + process.exit(1); + } + + console.warn("Skipping alias publish so the primary @gonkagate/claude-code release can complete."); + process.exit(0); +} + +if (!dryRun && isVersionPublished(ALIAS_PACKAGE_NAME, packageVersion)) { console.log(`${ALIAS_PACKAGE_NAME}@${packageVersion} is already published; skipping alias publish.`); process.exit(0); } From 423e3b32e9d604586624296848db3ea1923a7110 Mon Sep 17 00:00:00 2001 From: Daniil Koryto Date: Mon, 13 Apr 2026 12:04:50 +0300 Subject: [PATCH 2/3] fix: allow alias publish bootstrap override --- AGENTS.md | 2 +- CHANGELOG.md | 2 +- scripts/publish-alias-package.mjs | 15 ++++++++++----- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index af77ac9..95d5e24 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -247,7 +247,7 @@ Fallback entrypoints: Alias publishing: - `publish-alias-package.mjs` builds the `@gonkagate/claude-code-setup` alias package from the current root build output -- if that alias package is not visible on npm yet, the script skips alias publishing so the primary `@gonkagate/claude-code` release can complete; bootstrap the alias package and configure Trusted Publishing before requiring alias publish success +- if that alias package is not visible on npm yet, the script skips alias publishing so the primary `@gonkagate/claude-code` release can complete; bootstrap the alias package with `--allow-create-package` or `ALLOW_ALIAS_PACKAGE_CREATE=1`, then configure Trusted Publishing before requiring alias publish success They must not replace `npx` as the primary public UX. diff --git a/CHANGELOG.md b/CHANGELOG.md index ca7e481..9ba997b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ ## Unreleased -- Made alias package publishing skip cleanly until `@gonkagate/claude-code-setup` is bootstrapped on npm. +- Made alias package publishing skip cleanly until `@gonkagate/claude-code-setup` is bootstrapped on npm, with an explicit override for the first package publish. - Added `@gonkagate/claude-code-setup` as a setup-style alias for the existing Claude Code installer. - Improved npm package metadata and README copy for better package-page clarity, discovery, and onboarding. - Added a curated model registry and model picker to the public installer flow. diff --git a/scripts/publish-alias-package.mjs b/scripts/publish-alias-package.mjs index 50cc787..6e5b8c7 100644 --- a/scripts/publish-alias-package.mjs +++ b/scripts/publish-alias-package.mjs @@ -8,6 +8,8 @@ import { fileURLToPath } from "node:url"; const ALIAS_PACKAGE_NAME = "@gonkagate/claude-code-setup"; const ALIAS_BIN_NAME = "claude-code-setup"; const dryRun = process.argv.includes("--dry-run"); +const allowCreatePackage = process.argv.includes("--allow-create-package") + || process.env.ALLOW_ALIAS_PACKAGE_CREATE === "1"; const requireExistingPackage = process.argv.includes("--require-package") || process.env.REQUIRE_ALIAS_PACKAGE === "1"; @@ -78,15 +80,18 @@ const packageVersion = rootPackage.version; if (!dryRun && !canViewPackage(ALIAS_PACKAGE_NAME)) { console.warn(`${ALIAS_PACKAGE_NAME} is not visible on npm yet, or this publisher cannot access it.`); - console.warn(`Bootstrap ${ALIAS_PACKAGE_NAME} on npm and configure Trusted Publishing for this workflow, then rerun npm run publish:alias.`); - if (requireExistingPackage) { + if (allowCreatePackage) { + console.warn("Attempting first publish because alias package creation was explicitly allowed."); + } else if (requireExistingPackage) { + console.warn(`Bootstrap ${ALIAS_PACKAGE_NAME} on npm and configure Trusted Publishing for this workflow, then rerun npm run publish:alias.`); console.warn("Alias package publishing is required for this run, so failing now."); process.exit(1); + } else { + console.warn(`Bootstrap ${ALIAS_PACKAGE_NAME} on npm and configure Trusted Publishing for this workflow, then rerun npm run publish:alias.`); + console.warn("Skipping alias publish so the primary @gonkagate/claude-code release can complete."); + process.exit(0); } - - console.warn("Skipping alias publish so the primary @gonkagate/claude-code release can complete."); - process.exit(0); } if (!dryRun && isVersionPublished(ALIAS_PACKAGE_NAME, packageVersion)) { From 95295871b2b37f2742fbe76af3193c1ee8cd2e2f Mon Sep 17 00:00:00 2001 From: Daniil Koryto Date: Mon, 13 Apr 2026 12:10:30 +0300 Subject: [PATCH 3/3] fix: omit provenance for local alias bootstrap --- AGENTS.md | 1 + CHANGELOG.md | 1 + scripts/publish-alias-package.mjs | 8 +++++++- 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 95d5e24..c7fe7a1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -248,6 +248,7 @@ Alias publishing: - `publish-alias-package.mjs` builds the `@gonkagate/claude-code-setup` alias package from the current root build output - if that alias package is not visible on npm yet, the script skips alias publishing so the primary `@gonkagate/claude-code` release can complete; bootstrap the alias package with `--allow-create-package` or `ALLOW_ALIAS_PACKAGE_CREATE=1`, then configure Trusted Publishing before requiring alias publish success +- alias package publishing uses provenance only in GitHub Actions OIDC; local bootstrap publishes without provenance because npm cannot generate it outside a supported CI provider They must not replace `npx` as the primary public UX. diff --git a/CHANGELOG.md b/CHANGELOG.md index 9ba997b..83ad5f2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Unreleased +- Made local alias package bootstrap publish without npm provenance because provenance requires a supported CI/OIDC provider. - Made alias package publishing skip cleanly until `@gonkagate/claude-code-setup` is bootstrapped on npm, with an explicit override for the first package publish. - Added `@gonkagate/claude-code-setup` as a setup-style alias for the existing Claude Code installer. - Improved npm package metadata and README copy for better package-page clarity, discovery, and onboarding. diff --git a/scripts/publish-alias-package.mjs b/scripts/publish-alias-package.mjs index 6e5b8c7..d64867d 100644 --- a/scripts/publish-alias-package.mjs +++ b/scripts/publish-alias-package.mjs @@ -12,6 +12,10 @@ const allowCreatePackage = process.argv.includes("--allow-create-package") || process.env.ALLOW_ALIAS_PACKAGE_CREATE === "1"; const requireExistingPackage = process.argv.includes("--require-package") || process.env.REQUIRE_ALIAS_PACKAGE === "1"; +const disableProvenance = process.argv.includes("--no-provenance") + || process.env.DISABLE_ALIAS_PACKAGE_PROVENANCE === "1"; +const canUseGitHubActionsProvenance = process.env.GITHUB_ACTIONS === "true" + && process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN !== undefined; const scriptDir = dirname(fileURLToPath(import.meta.url)); const repoRoot = resolve(scriptDir, ".."); @@ -136,8 +140,10 @@ try { const publishArgs = ["publish", "--access", "public"]; if (dryRun) { publishArgs.push("--dry-run"); - } else { + } else if (canUseGitHubActionsProvenance && !disableProvenance) { publishArgs.push("--provenance"); + } else { + console.warn("Publishing without provenance because this is not a GitHub Actions OIDC environment."); } run("npm", publishArgs, { cwd: packageRoot });