From 65247c9320aad238f88f99ca08b9c0611b30a863 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 4 Sep 2026 23:26:28 +0200 Subject: [PATCH] release: @whynot/design v0.4.2 on Forgejo Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43 --- .npmrc | 8 +-- BOOTSTRAP.md | 6 +- CHANGELOG.md | 9 +++ CONSUMING.md | 2 +- CONTRIBUTING.md | 2 +- DesignSystemIntroduction.md | 6 +- MultiFrameworkSupport.md | 2 +- PUBLISHING.md | 11 ++-- README.md | 2 +- ir/INDEX.md | 2 +- ir/manifest.json | 4 +- package.json | 2 +- .../WHYNOT-WP-0004-forgejo-npm-migration.md | 55 +++++++++++++++++++ 13 files changed, 88 insertions(+), 23 deletions(-) create mode 100644 workplans/WHYNOT-WP-0004-forgejo-npm-migration.md diff --git a/.npmrc b/.npmrc index 8c0c82b..151ba3c 100644 --- a/.npmrc +++ b/.npmrc @@ -1,6 +1,6 @@ -# @whynot/* is published to and installed from the coulomb Gitea npm registry. +# @whynot/* is published to and installed from the coulomb Forgejo npm registry. # The auth token is NOT stored here — set NPM_AUTH_TOKEN in your shell/CI. # It is operator/OpenBao-owned (credential-routing.md: tokens route, never vend); -# obtain a Gitea package token from the operator. Publish flow: see PUBLISHING.md. -@whynot:registry=https://gitea.coulomb.social/api/packages/coulomb/npm/ -//gitea.coulomb.social/api/packages/coulomb/npm/:_authToken=${NPM_AUTH_TOKEN} +# obtain a Forgejo package token through the governed lane. Publish flow: see PUBLISHING.md. +@whynot:registry=https://forgejo.coulomb.social/api/packages/coulomb/npm/ +//forgejo.coulomb.social/api/packages/coulomb/npm/:_authToken=${NPM_AUTH_TOKEN} diff --git a/BOOTSTRAP.md b/BOOTSTRAP.md index 5eb7aff..5e7cea1 100644 --- a/BOOTSTRAP.md +++ b/BOOTSTRAP.md @@ -19,7 +19,7 @@ ls -la # .gitea/ .github/ scripts/ tests/ # 3. Replace placeholder host names. -# Search-and-replace `gitea.example.com` with your actual Gitea host in: +# Search-and-replace `forgejo.example.com` with your actual Forgejo host in: # - package.json # - .npmrc # - .gitea/workflows/ci.yml (and .github/ if you keep that) @@ -54,8 +54,8 @@ git push ## Notes -- The `git+ssh` URL in `package.json` (`gitea.example.com/whynot/whynot-design.git`) is a placeholder. Replace with your actual Gitea host. -- The same goes for `.npmrc` and the registry URL in `.gitea/workflows/ci.yml` (commented out — uncomment when you stand up a Gitea Packages registry). +- The `git+ssh` URL in `package.json` (`forgejo.example.com/whynot/whynot-design.git`) is a placeholder. Replace with your actual Forgejo host. +- The same goes for `.npmrc` and the registry URL in `.gitea/workflows/ci.yml` (commented out — uncomment when you stand up a Forgejo Packages registry). - `.gitea/workflows/ci.yml` and `.github/workflows/ci.yml` are identical. Keep whichever your forge uses and delete the other. - The `examples/showcase/index.html` page uses `importmap` to load Lit from esm.sh **for the standalone-no-build case**. When you have a bundler in the consuming app, the bundler resolves `lit` from `node_modules` and the importmap is irrelevant. diff --git a/CHANGELOG.md b/CHANGELOG.md index 9931009..d481f38 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,15 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Version ## [Unreleased] +## [0.4.2] — 2026-09-04 + +### Changed + +- **Forgejo is now the canonical package registry** (WHYNOT-WP-0004). Package, + consumer, and release configuration consistently use + `https://forgejo.coulomb.social/api/packages/coulomb/npm/`; the legacy Gitea + publication remains historical evidence only. + ### Added - **Lit adapter completed + refresh pipeline** (WHYNOT-WP-0002, Phases 3–6). The diff --git a/CONSUMING.md b/CONSUMING.md index 76c8950..ee45762 100644 --- a/CONSUMING.md +++ b/CONSUMING.md @@ -23,7 +23,7 @@ This is the inverse of whynot-design's own upstream machinery ## 1. Pin a version -`@whynot/design` is published to the coulomb Gitea npm registry. Pin an exact +`@whynot/design` is published to the coulomb Forgejo npm registry. Pin an exact tagged version; your lockfile becomes the real pin. ```bash diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 0632878..a946b5e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -73,7 +73,7 @@ After PR merge: 1. Bump `package.json` version following the [versioning rules in `DesignSystemIntroduction.md` §5](./DesignSystemIntroduction.md#5-versioning-discipline). 2. Move the `## [Unreleased]` block in `CHANGELOG.md` under a new `## [vX.Y.Z] — YYYY-MM-DD` header. 3. Tag: `git tag vX.Y.Z && git push --tags`. -4. CI's release workflow attaches the CHANGELOG slice to the Gitea release. (If publishing to a registry, this is where `npm publish` runs.) +4. CI's release workflow attaches the CHANGELOG slice to the Forgejo release. (If publishing to a registry, this is where `npm publish` runs.) 5. Renovate picks up the new tag in consumer repos within ~24h. Or manually: ```sh diff --git a/DesignSystemIntroduction.md b/DesignSystemIntroduction.md index 931e36f..c904c2a 100644 --- a/DesignSystemIntroduction.md +++ b/DesignSystemIntroduction.md @@ -112,15 +112,15 @@ In order of effort: **a) pnpm workspaces (recommended for now)** — put `whynot-design` and your consuming app in the same monorepo (or use `file:` / `link:` references). Zero registry, zero auth, instant updates. -**b) Install directly from Gitea** — no registry needed. +**b) Install directly from Forgejo** — no registry needed. ```sh -pnpm add git+ssh://git@gitea.example.com/whynot/whynot-design.git#v0.2.0 +pnpm add git+ssh://git@forgejo.coulomb.social/coulomb/whynot-design.git#v0.2.0 ``` Pin to a tag, not `main`. Tag-pinning is the entire versioning discipline at A1. -When you outgrow either (second team needs read access without cloning, semver resolution becomes valuable), publish to **Gitea Packages** (native npm protocol) or a private Verdaccio. +When you outgrow either (second team needs read access without cloning, semver resolution becomes valuable), publish to **Forgejo Packages** (native npm protocol) or a private Verdaccio. ### 4.2 What a consumer imports diff --git a/MultiFrameworkSupport.md b/MultiFrameworkSupport.md index 8a75e5f..5aafcdb 100644 --- a/MultiFrameworkSupport.md +++ b/MultiFrameworkSupport.md @@ -109,7 +109,7 @@ This is the canonical non-React case and worth covering in detail. ```sh # In the Django app's repo. -pnpm add git+ssh://git@gitea.example.com/whynot/whynot-design.git#v0.2.0 +pnpm add git+ssh://git@forgejo.coulomb.social/coulomb/whynot-design.git#v0.2.0 # Or vendor without Node tooling — copy three files: mkdir -p myapp/static/whynot diff --git a/PUBLISHING.md b/PUBLISHING.md index a75cf8a..49c9ee5 100644 --- a/PUBLISHING.md +++ b/PUBLISHING.md @@ -1,6 +1,6 @@ # Publishing `@whynot/design` -`@whynot/design` is published to the **coulomb Gitea npm registry** so consuming +`@whynot/design` is published to the **coulomb Forgejo npm registry** so consuming repos can pin a version (`npm i @whynot/design@x.y.z`) and track it at their own pace (WHYNOT-WP-0003). The git tag cut by `make release` (see `DesignSystemIntroduction.md` §6) is the version; publishing makes that version installable. @@ -12,13 +12,14 @@ repos can pin a version (`npm i @whynot/design@x.y.z`) and track it at their own ## The token (never commit it) -Publishing and installing `@whynot/*` need a Gitea package token. It is **not stored in +Publishing and installing `@whynot/*` need a Forgejo package token. It is **not stored in this repo** — per `.claude/rules/credential-routing.md`, tokens are routed, not vended: -a Gitea package token is operator/OpenBao-owned (`railiance-platform`). Obtain one from -the operator and export it: +a Forgejo package token is operator/OpenBao-owned (`railiance-platform`). Use the +`whynot-design-npm-publish` governed lane for publishing; interactive operators may +export a value obtained through the same route: ```sh -export NPM_AUTH_TOKEN=… # Gitea package token; never paste into git/chat/logs +export NPM_AUTH_TOKEN=… # Forgejo package token; never paste into git/chat/logs ``` `.npmrc` (committed) references it via `${NPM_AUTH_TOKEN}` — no secret lives in the file. diff --git a/README.md b/README.md index c20a1d1..5b5c9fa 100644 --- a/README.md +++ b/README.md @@ -38,7 +38,7 @@ Framework-agnostic by design. Consumers do **not** re-implement components per f ### Node-tooled consumer (React, Vite, Next, Vue, …) -Install from the coulomb Gitea npm registry (add the scope to your `.npmrc` first — see +Install from the coulomb Forgejo npm registry (add the scope to your `.npmrc` first — see [`PUBLISHING.md`](./PUBLISHING.md) for the token). `lit` is a peer dependency: ```ini diff --git a/ir/INDEX.md b/ir/INDEX.md index 9be4ac7..016ed57 100644 --- a/ir/INDEX.md +++ b/ir/INDEX.md @@ -1,7 +1,7 @@ # whynot-design IR catalog -**designVersion** `0.4.0` · **components** 10 · **generated** 2026-06-30T07:46:35.138Z +**designVersion** `0.4.2` · **components** 10 · **generated** 2026-09-04T21:25:01.914Z Machine-readable companion: [`manifest.json`](./manifest.json) (per-component + token hashes). diff --git a/ir/manifest.json b/ir/manifest.json index 91a5511..d39ee7e 100644 --- a/ir/manifest.json +++ b/ir/manifest.json @@ -1,7 +1,7 @@ { "schemaVersion": "1.0.0", - "designVersion": "0.4.0", - "generatedAt": "2026-06-30T07:46:35.138Z", + "designVersion": "0.4.2", + "generatedAt": "2026-09-04T21:25:01.914Z", "tokensHash": "sha256:426f565a9ce6c36f", "components": [ { diff --git a/package.json b/package.json index c7bab7e..6626563 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@whynot/design", - "version": "0.4.1", + "version": "0.4.2", "description": "The neutral, mostly-black-and-white visual language for whynot — prototype cards, signal records, beta plans, decision documents, and any other deliberately-unfinished artefact. Ships tokens, CSS, and Lit-based web components consumable from React, Django, Vue, plain HTML, or anywhere a custom element runs.", "private": false, "type": "module", diff --git a/workplans/WHYNOT-WP-0004-forgejo-npm-migration.md b/workplans/WHYNOT-WP-0004-forgejo-npm-migration.md new file mode 100644 index 0000000..fa25970 --- /dev/null +++ b/workplans/WHYNOT-WP-0004-forgejo-npm-migration.md @@ -0,0 +1,55 @@ +--- +id: WHYNOT-WP-0004 +type: workplan +title: "Move @whynot/design publication to Forgejo Packages" +domain: infotech +repo: whynot-design +status: active +owner: codex +topic_slug: forgejo-npm-migration +created: "2026-09-04" +updated: "2026-09-04" +--- + +## Reconcile the package release state + +```task +id: WHYNOT-WP-0004-T01 +status: done +priority: high +``` + +Audit the partially completed Forgejo migration, choose a new immutable package +version when the existing Gitea release cannot be reused safely, and verify the +release contents before any credentialed write. This work promotes routed intake +`01a06e08-6936-7762-a347-f832182b7705`. + +## Publish and verify the Forgejo package + +```task +id: WHYNOT-WP-0004-T02 +status: progress +priority: high +``` + +Use the governed `whynot-design-npm-publish` credential lane to publish the new +version to `https://forgejo.coulomb.social/api/packages/coulomb/npm/`. Verify an +authenticated exact-version install and the shipped IR/version contract without +printing or persisting the credential. + +## Align consumer and operator documentation + +```task +id: WHYNOT-WP-0004-T03 +status: done +priority: medium +``` + +Make Forgejo the single canonical npm endpoint in current package, consumer, and +release guidance. Hand the verified endpoint to ops-warden for catalog and +playbook reconciliation. + +Prepared `@whynot/design@0.4.2` on 2026-09-04. The package dry-run contains 105 +files with IR `designVersion` 0.4.2; all five Playwright visual tests pass. The +changelog gate correctly reports no *post-release* `[Unreleased]` entry after the +0.4.2 section was cut.