From 09fdb0663c3ed12b7c12b2ccb02fbf7eef224092 Mon Sep 17 00:00:00 2001 From: James Maes Date: Sun, 8 Nov 2026 07:27:55 -0600 Subject: [PATCH] ci: Gitea CI publishes the release from the tag; 1.1.1-rc.1 build.yaml sets publish: true with release-files dist/* on the shared node.yaml (@main until ci-workflows v1 moves): a v tag reruns every check, bundles, and creates the Gitea release with the archive, SHA256SUMS and the CHANGELOG section. Replaces the retired GitHub release + attestation path (Gitea has no attestation equivalent). 1.1.1-rc.1 is the pipeline proof, with no contract change. Co-Authored-By: Claude Opus 5.5 --- .gitea/workflows/build.yaml | 8 +++++++- CHANGELOG.md | 7 +++++++ CONTRIBUTING.md | 2 +- docs/INTEGRATION.md | 2 +- package-lock.json | 4 ++-- package.json | 2 +- 6 files changed, 19 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml index 04e0376..2a5cd7e 100644 --- a/.gitea/workflows/build.yaml +++ b/.gitea/workflows/build.yaml @@ -6,7 +6,8 @@ on: push: jobs: node: - uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/node.yaml@v1 + # @main until the owner moves ci-workflows v1 onto the publishing node.yaml; then back to @v1. + uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/node.yaml@main with: node-version: '24' install: npm ci --ignore-scripts @@ -21,3 +22,8 @@ jobs: npm run lint npm run check npm run bundle + # A v tag creates the Gitea release with the bundle, SHA256SUMS and the + # CHANGELOG section (-rc.N -> prerelease). The package is private: nothing goes to npm. + publish: true + npm-publish-dirs: '' + release-files: dist/* diff --git a/CHANGELOG.md b/CHANGELOG.md index fa212e0..0f583f3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## 1.1.1-rc.1 + +Release-pipeline candidate: no schema, fixture or wire change from 1.1.0. The +first release built and published by Gitea CI from the tag (bundle, `SHA256SUMS` +and these notes), replacing the hand-published Gitea release and the retired +GitHub release with attestation. + ## 1.1.0 Additive contract for printing semantic extension **2.4.0**. Wire payload stays diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 7e2abb0..f4f31ad 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -8,7 +8,7 @@ Run both the Java and .NET consumers' protocol tests for a contract change. Chec Keep wire-v1 payload names stable for native `/qqq/v1/qbit/printing` and explicit legacy `/printing/v1` routes. Optional response fields may be added; clients ignore unknown response fields. Removing/renaming a field, changing its type or changing an existing field's meaning requires explicit versioned compatibility design. Package, printing extension, wire and WebSocket subprotocol versions are independent; see [the version registry](docs/VERSIONS.md). A package version is not permission to silently break an already deployed connector. -`npm run bundle` produces the release archive and checksum in `dist/`. Do not hand-edit generated checksums. Release tags must match the version in package.json, prefixed with `v`. Maintainers publish reviewed artifacts on [Gitea releases](https://git.kof22.com/QRun-IO/qqq-print-protocol/releases). GitHub Actions for this repository were retired on 2026-11-04; retained `.github/scripts` remain local/shared-CI tooling. See [current release provenance](docs/INTEGRATION.md#stable-printing-release) before updating consumer fixture pins. +`npm run bundle` produces the release archive and checksum in `dist/`. Do not hand-edit generated checksums. Release tags must match the version in package.json, prefixed with `v`. A `v` tag on the reviewed merge commit makes Gitea CI rerun every check, build the bundle and create the [Gitea release](https://git.kof22.com/QRun-IO/qqq-print-protocol/releases) with the archive, a fresh `SHA256SUMS` (the bundle's own is checked first) and the matching CHANGELOG section as notes (a `-rc.N` version is a prerelease). Gitea has no equivalent of the retired GitHub artifact attestation: verify downloads against `SHA256SUMS` and the tag. GitHub Actions for this repository were retired on 2026-11-04; retained `.github/scripts` remain local/shared-CI tooling. See [current release provenance](docs/INTEGRATION.md#stable-printing-release) before updating consumer fixture pins. ## Script quality diff --git a/docs/INTEGRATION.md b/docs/INTEGRATION.md index b27e971..ff193c8 100644 --- a/docs/INTEGRATION.md +++ b/docs/INTEGRATION.md @@ -102,4 +102,4 @@ npm run bundle The check runs full draft-2020-12 schema compilation and fixture validation with Ajv, plus independent content/hash/base64 and invalid-input checks. `node tools/verify-fixtures.mjs` remains available without installing dependencies for a quick subset check. -The bundle includes specification, schema, fixtures, tools, dependency manifests and lockfile, and license metadata, excluding installed dependencies. Consumers do not need Node.js to use the schema or fixture JSON. Maintainers publish the bundle and checksum on [Gitea releases](https://git.kof22.com/QRun-IO/qqq-print-protocol/releases); no npm registry publication is performed. Protocol GitHub Actions were retired on 2026-11-04; retained files and historical results do not imply a new hosted build or attestation. +The bundle includes specification, schema, fixtures, tools, dependency manifests and lockfile, and license metadata, excluding installed dependencies. Consumers do not need Node.js to use the schema or fixture JSON. Gitea CI publishes the bundle and checksum on [Gitea releases](https://git.kof22.com/QRun-IO/qqq-print-protocol/releases) from a `v` tag; no npm registry publication is performed and there is no artifact attestation (Gitea has no equivalent). Protocol GitHub Actions were retired on 2026-11-04; retained files and historical results do not imply a new hosted build or attestation. diff --git a/package-lock.json b/package-lock.json index 343ef65..de3e456 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@qrun-io/qqq-print-protocol", - "version": "1.1.0", + "version": "1.1.1-rc.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@qrun-io/qqq-print-protocol", - "version": "1.1.0", + "version": "1.1.1-rc.1", "license": "Apache-2.0", "devDependencies": { "@eslint/js": "10.0.1", diff --git a/package.json b/package.json index 36099f1..25c103c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@qrun-io/qqq-print-protocol", - "version": "1.1.0", + "version": "1.1.1-rc.1", "private": true, "description": "Versioned wire contract and compatibility fixtures for QQQ cloud printing.", "license": "Apache-2.0", -- 2.54.0