Conversation
…neering Move the plugin onto SDK 0.8.0 (proven consumer-compatible) plus safe, non-breaking tooling bumps and the metadata/tooling a first publish needs. Dependencies: - @37signals/basecamp 0.7.3 -> 0.8.0 - @sinclair/typebox ^0.34.51 -> ^0.34.52 - @biomejs/biome ^2.5.3 -> 2.5.4 (exact); biome.json $schema re-pinned to 2.5.4 - vitest ^4.0.18 -> ^4.1.10 (lockstep with @vitest/coverage-v8) - Remove the no-op @hono/node-server override (root override never touched openclaw's nested dev-only copy; no 1.x is secure per GHSA-frvp-7c67-39w9, a dev-only exposure deferred to the OpenClaw adaptation) - Hold openclaw (2026.7.1 breaks channel.ts) and typescript (7.x major) Tooling: - .mise.toml pinning node 22.23.1 (satisfies openclaw's >=22.19.0 floor) - .editorconfig matching biome's 2-space formatter - LICENSE (MIT) Publishing: - package.json license/repository/publishConfig for provenance - release.yml publish job -> Node 24 (npm >= 11.5.1 for OIDC trusted publishing) - RELEASING.md documenting the first-publish bootstrap sequence
There was a problem hiding this comment.
Pull request overview
Updates the Basecamp channel plugin’s dependency set (notably @37signals/basecamp) and tightens release/dev tooling metadata to support an initial npm publish bootstrap followed by tag-driven OIDC publishing via GitHub Actions.
Changes:
- Bumps
@37signals/basecampto0.8.0and refreshes a few dev dependencies (Biome + Vitest + TypeBox). - Adds publishing/provenance metadata (
license,repository,publishConfig.access) and introducesRELEASING.md+LICENSE. - Pins local dev Node via
.mise.toml, aligns editor formatting via.editorconfig, and switches the release publish job to Node 24 (npm ≥ 11.5.1 for OIDC trusted publishing).
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| RELEASING.md | Documents one-time npm bootstrap publish + subsequent tag-driven OIDC publishing flow. |
| package.json | Adds publish metadata and bumps dependency versions (Basecamp SDK / tooling). |
| package-lock.json | Lockfile updates reflecting the dependency/version changes. |
| LICENSE | Adds MIT license text for the package/repo. |
| biome.json | Re-pins Biome schema to match the updated Biome CLI version. |
| .mise.toml | Pins local dev Node version for consistent setup. |
| .github/workflows/release.yml | Runs the publish job on Node 24 to ensure npm supports trusted publishing requirements. |
| .editorconfig | Aligns editor defaults with the project’s 2-space formatting expectations. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3a47fc6045
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
jeremy
commented
Jul 23, 2026
…n, release-env precondition - LICENSE: copyright holder -> 37signals LLC - .mise.toml: dev Node 24.18.0 (latest LTS), aligning with the publish job; full check + build + pack re-verified green on Node 24 (npm 11.16.0) - RELEASING.md: npm trust list runs on the dev Node directly (npm 11.16); document that a missing release environment is auto-created UNPROTECTED, so creating+protecting it is a hard precondition for pushing any v* tag
Documentation alone does not make the release hold fail closed: GitHub auto-creates a referenced-but-missing environment WITHOUT protection rules, so `environment: release` on the publish job is not a gate. Add a release-preflight job that runs before publish (in publish.needs), reads the release environment via the API (actions: read, no id-token), and fails the release on a tag push unless the environment exists with at least one required reviewer and a deployment policy. Dry-runs skip the check. The OIDC-capable publish job never starts until protection is proven. RELEASING.md: document the enforced gate; specify 'at least one required reviewer and a v* tag deployment policy' rather than the ambiguous earlier wording; renumber steps.
Member
Author
|
@codex review |
The earlier check only asserted deployment_branch_policy != null, which the error text and docs over-claimed as a 'v* tag policy'. A null-check passes a policy that allows any ref, and even passes a protected-branches-only policy that would actually block the tag deploy. Tighten it: require custom_branch_policies == true, then read the deployment-branch-policies API and require at least one type: tag rule. Message and RELEASING.md now state exactly what is enforced (a custom tag rule exists) versus the recommended pattern (v*), which the operator sets.
Member
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves
@37signals/openclaw-basecamponto SDK 0.8.0 and freshens dev-setup / release-engineering — the TypeScript analogue of thebasecamp-mcp-serverfreshen-up. Scoped to the proven-safe projection; the OpenClaw 2026.7.1 bump (proven to break typecheck/build atsrc/channel.ts:136) and the TypeScript 7 major (deferred as a separate major, not a proven break) are both held for a follow-up adaptation PR.Dependencies (exact targets — no
npm update, held pins preserved)@37signals/basecamp0.7.30.8.0@sinclair/typebox^0.34.51^0.34.52@biomejs/biome(dev)^2.5.32.5.4(exact)biome.json$schemare-pinned to 2.5.4.vitest+@vitest/coverage-v8(dev)^4.0.18/^4.1.10^4.1.10(both)openclaw(dev)2026.6.11channel.ts:136.typescript(dev)^6.0.3Dropped the
@hono/node-serveroverride — it was a no-op (the root override never touched openclaw's nested dev-only copy), and no 1.x is secure (GHSA-frvp-7c67-39w9 affects all< 2.0.5). This is a dev-only exposure with no production reachability; remediation rides with the OpenClaw adaptation.Tooling & publishing
.mise.toml— pins Node24.18.0(latest LTS; satisfies openclaw's>=22.19.0floor and aligns dev with the publish job)..editorconfig— matches biome's 2-space formatter.LICENSE— MIT (Copyright (c) 37signals LLC).package.json—license/repository(canonicalgit+https://) /publishConfig.accessfor provenance.release.yml—publishjob → Node 24 (npm ≥ 11.5.1 for OIDC trusted publishing);test/securitystay on Node 22. Adds arelease-preflightjob (fail-closed gate,actions: read, noid-token) that blocks publication on a tag push unless thereleaseenvironment exists with a required reviewer and a custom tag deployment rule (recommended patternv*) — so a stray tag can't reach OIDC publish against an auto-created, unprotected environment. No action-SHA pins touched (those are deps(actions): bump the github-actions group with 5 updates #144's).RELEASING.md— documents the first-publish bootstrap (the package is 404 / never published, and OIDC trusted publishing requires the package to exist first).Verification (Node 24.18.0 via mise — all green)
npm run check— typecheck + biome lint + 1,152 tests (10 skipped)npm run build— clean tsc → distscripts/verify-pack.sh— extension target present in packsrc/**churn, nouses: …@<sha>changesRelease execution is held
Landing this PR does not publish. Creating the
releaseGitHub environment, the authorized bootstrap publish, and configuring the npm trusted publisher are post-merge operator actions under separate authorization (seeRELEASING.md).Dependabot disposition