6 Commits

Include renames

Author	SHA1	Message	Date
pyh	06889ab3ec	ci: point the default registry at Gitea and recognise npm's duplicate-version error ... Without setup-node nothing wrote the default registry, so npm compared versions against registry.npmjs.org and refused with 'cannot publish over the previously published versions'. The step now sets the default registry too, and treats both that message and Gitea's 409 as an idempotent skip.	2026-09-30 11:35:43 +08:00
pyh	a3fbe602ff	ci: drop the external actions so the runner never needs github.com ... Runs 11 and 14 died on 'dial tcp 20.205.243.166:443: i/o timeout' while act_runner cloned actions/checkout from GitHub. The workflow now fetches its own ref with git and relies on the node already present in the runner image, so it only touches this instance.	2026-09-30 11:33:51 +08:00
pyh	3a806f84ab	ci: treat an already-published version as a skip, not a failure ... The registry check through npm view did not see the existing version, so publish ran into E409. The registry itself is the authority here: a 409 now reports 'already exists, skipping' and exits zero, while every other error still fails the step.	2026-09-30 11:31:42 +08:00
pyh	f4e107782a	ci: make a repeated release a no-op and drop the misleading diagnostics ... Gitea does not implement the npm whoami endpoint and npm refuses to read an auth token back, so both lines only produced error-looking output. The run now checks the registry first and skips publishing a version that already exists, which also makes a manual re-run safe.	2026-09-30 11:28:57 +08:00
pyh	733f0ba456	ci: fall back to a PAT and self-diagnose the publish step ... The first tagged run failed inside the publish step within a second, which is the shape of an auth rejection rather than a build problem. The step now prefers a repository NPM_TOKEN secret when one exists, prints the effective registry and a masked token, and runs npm whoami so a re-run names the cause instead of just failing.	2026-09-30 11:05:33 +08:00
pyh	37468d6ac9	feat!: publish as @dsh-plugin/session-delete with an automated Gitea npm release ... The registry owner is the scope the package must publish under, so the name moves from @local/ to @dsh-plugin/ in all three places that must agree: package.json, cordis.patch.yml, and the client module id. `private` goes away because npm refuses to publish such a package, and publishConfig pins the registry to this organization's npm endpoint. The tag workflow publishes whatever version the pushed v* tag names, using the built-in Gitea job token, and refuses a tag that disagrees with package.json.	2026-09-30 11:00:39 +08:00