mirror of
https://git.pumpin.online/funkpower/catena.git
synced 2026-10-22 18:57:14 +00:00
funkpower
699f7bfb1c
Publishing by hand needs a laptop with two credentials on it, and gets the gate only if whoever ran it remembered. This runs the same `check.sh` every push runs, then builds and uploads — and refuses at the first step if the tag and the workspace version disagree, because a release tagged v0.3.0 that publishes 0.2.0 cannot be undone: PyPI will not reuse a version even after it is yanked. Wheels are cross-compiled with zig for x86_64 and aarch64 against an older glibc than the build image ships, so they are not silently pinned to bookworm's, and an sdist covers everything else. PyPI is uploaded directly. npm is only staged: npm is withdrawing direct publish from tokens that bypass 2FA, and its trusted publishing is OIDC against GitHub and GitLab, which this forge is neither. So the runner does the part a token may do, and a maintainer approves the tarball with 2FA. A missing NPM_TOKEN is a warning rather than a failure, so a release can go to PyPI while the npm credential is still being sorted out.
8 lines
123 B
Plaintext
8 lines
123 B
Plaintext
target/
|
|
*.profraw
|
|
.DS_Store
|
|
|
|
# Built npm package; `crates/bindings/npm/build.sh` makes it.
|
|
crates/bindings/npm/dist/
|
|
dist/
|