T-75UD-release-ci-dist-repo

Status: closed/obsoleted · Impact: medium · Complexity: medium

Goal

D-0014’s private-phase channel is a git-pinned dist repo: release CI builds the publishable tree and pushes it to a private repo consumers pin as a git dependency (#vX.Y.Z), riding existing git credentials — no registry, no .npmrc. Today the repo has no CI at all (no .github/workflows/), so this task creates both the release pipeline and the channel it publishes to.

Partial progress — the pipeline is drafted. .github/workflows/release.yml (tag-triggered build → quality roster → sdlc plugin build-artifact → plain-Node smoke → push to sksizer/sdlc-dist, with a workflow_dispatch dry_run path) and the README “Releasing & the dist channel” section (install forms, consumer read-credential, upgrade + release flow) are in place. Remaining — owner steps that can’t be scripted from here: (1) gh repo create sksizer/sdlc-dist --private; (2) add the SDLC_DIST_DEPLOY_KEY Actions secret (write deploy-key private half); (3) cut v0.3.0 end to end and verify a scratch-machine install (AC-1/-2/-3 in practice). Kept open/ready until the channel is stood up and a real tag is proven.

Today

Location	Role today
plugin/lib/services/plugin/ops/	home of the plugin ops; T-XTGT adds build-artifact here — the op this pipeline runs and ships
sdlc.yaml	the quality-check roster a release must be green on
package.json	version source of truth after T-XTGT’s unification; release tags must agree with it
README.md	no distribution/consumer-install documentation yet

No .github/workflows/ directory exists; the dist repo (sksizer/sdlc-dist) does not exist yet.

Proposed

Pushing tag vX.Y.Z produces, without manual steps: a quality-gated build, a commit on the private sksizer/sdlc-dist repo whose tree is the publishable package (package.json at root), tagged vX.Y.Z there too. A consumer installs with bun add git+ssh://git@github.com/sksizer/sdlc-dist#vX.Y.Z (or the https form under npm) and gets exactly what npm pack would have produced. Install and CI-credential instructions are documented.

Approach

1. Create the private sksizer/sdlc-dist repo (gh repo create sksizer/sdlc-dist --private); seed a README explaining it is a build-artifact mirror — no hand commits, history is release history, source lives in sksizer/dev.
2. Add .github/workflows/release.yml, triggered on push: tags: ['v*']: a. Checkout; install Bun (setup action) and Node ≥20 (both runtimes: Bun to run the toolchain, Node for the artifact smoke). b. bun install; assert tag == root package.json version (fail early on mismatch). c. Run the quality-check roster from sdlc.yaml (the same commands, verbatim). d. sdlc plugin build-artifact --out dist-pkg/. e. Artifact smoke with Bun removed from PATH: node dist-pkg/plugin/cli/sdlc.js --help and … project doctor --output json. f. Publish: clone sksizer/sdlc-dist with a deploy key (write) from repo secrets; replace its tree with dist-pkg/ contents; commit release: vX.Y.Z (<source sha>); tag vX.Y.Z; push branch + tag.
3. Credentials: generate a write deploy key for sdlc-dist; store the private half as a sksizer/dev Actions secret; document the consumer-side read credential (a PAT or read deploy key — the default per-repo Actions token cannot fetch other private repos).
4. Document the channel in README.md: install commands (bun + npm git forms, tag pinning), the consumer-CI credential requirement, and the upgrade flow (bump the pinned ref; lockfile records the commit sha).
5. Dry-run path: workflow_dispatch input dry_run: true runs a–e and skips f, so the pipeline is testable without publishing.
6. Cut v0.3.0 end to end and verify a scratch-machine install from the dist repo tag.

Files to touch

Location	Kind	Change
.github/workflows/release.yml	new	tag-driven build → gate → smoke → push-to-dist pipeline with workflow_dispatch dry-run
README.md	modify	distribution section: install forms, tag pinning, consumer-CI credential, upgrade flow
docs/planning/decisions/D-0014-cli-primary-npm-distribution.md	modify	note the concrete dist-repo name and workflow file once live (Migration step 6 fulfilled)

Acceptance criteria

• AC-1: pushing tag vX.Y.Z (matching package.json) yields a sksizer/sdlc-dist commit tagged vX.Y.Z whose root is the publishable package; a tag/version mismatch fails the workflow before building.
• AC-2: in a scratch project, bun add git+ssh://git@github.com/sksizer/sdlc-dist#vX.Y.Z installs; bunx sdlc --help and — with Bun absent — npx sdlc --help both exit 0.
• AC-3: the workflow’s smoke step runs the staged CLI under Node with Bun stripped from PATH and fails the release when it exits non-zero.
• AC-4: workflow_dispatch with dry_run: true completes without touching sdlc-dist.
• AC-5: README documents both install forms and the consumer-CI read-credential requirement.

Out of scope

• The build op itself (T-XTGT).
• Public npm publishing — the recorded public-phase channel, not now.
• Renovate/automation for consumer-side version bumps — consumers pin refs manually during the private phase.
• General-purpose CI for PRs (quality checks on every push) — worth doing, separate concern; this task ships the release workflow only.

Dependencies

• T-XTGT (hard, in depends_on): the pipeline is a thin shell around sdlc plugin build-artifact.
• T-WGV4 transitively, for the Node smoke to pass.

Discovery context

• D-0014 Migration step 6 and the Registry-while-private decision (git-pinned dist repo chosen over GitHub Packages; PR #571 review thread).

Depends on

T-XTGT-publish-build-and-package-reshape

---

← Back to Tasks