From b1ae1eb23cadde14df5dbf03eb47da272e9df233 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 21 Sep 2026 07:12:26 +0000 Subject: [PATCH] chore(docs): update AGENTS.md to reflect recent changes Document the OIDC-404 publish retry wrapper added in #88 (scripts/run-with-retry.mjs), which scripts/publish-snapshot.mjs now uses but the tagged-release publish script does not yet. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_014vf32fx4mkAqvKopnNpjbF --- AGENTS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/AGENTS.md b/AGENTS.md index 1de8cb6c..219c4194 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -36,6 +36,7 @@ There is **no runnable app, frontend, backend, dev server, or database**. "Runni - CI runs on GitHub-hosted runners (`ubuntu-24.04-arm` for `ci.yml` and `pkg-pr-new.yml`, `ubuntu-latest` for `release.yml`) — not Blacksmith, despite some now-superseded PR history. - When adding a new package, add a matching `packages:` entry to **both** `.github/labels.yml` (label sync) and `.github/labeler.yml` (path-based auto-labeling on PRs) — these can drift independently (e.g. `plugin-subcommands-advanced` currently has a label defined but no `labeler.yml` path mapping, so it's never auto-applied). - Releases publish via CI (`release.yml`) using npm [trusted publishing](https://docs.npmjs.com/trusted-publishers/) (OIDC, no long-lived token) so npm provenance/Sigstore attestation is attached; local `changeset publish` can't mint attestations. See `.changeset/README.md`. +- `pnpm run publish:snapshot` (`scripts/publish-snapshot.mjs`, run by the `snapshot` job on every push to `main` touching `packages/`) wraps `changeset publish` in `scripts/run-with-retry.mjs`, retrying up to 3 times (20s apart) because `changeset publish` fires one concurrent OIDC token exchange per package and npm intermittently 404s a subset instead of rate-limiting; already-published versions are skipped on retry. `pnpm run publish` (the tagged-release path, invoked by `changesets/action` via `release.yml`) does not use this retry wrapper yet. - Every push to any branch (see `.github/workflows/pkg-pr-new.yml`) builds the packages and publishes preview tarballs to [pkg.pr.new](https://pkg.pr.new) via `pnpm exec pkg-pr-new publish`, so unreleased changes from any branch/PR can be installed directly without waiting for a real release. ### Exercising the core functionality (ApiServer)