From 7a282d16160c948b2b29dfc1f5e554c2e2a3fa37 Mon Sep 17 00:00:00 2001 From: OB Date: Fri, 15 May 2026 15:09:44 +0700 Subject: [PATCH] docs(clone): align badges with sparkline + switch publish to OIDC - README badge block now matches sparkline: npm first, ci second (label=ci), drop the branch-stable badge. - ci.yml stops forwarding NPM_PACKAGE_REGISTRY_TOKEN so the reusable workflow takes the OIDC + provenance path. The Trusted Publisher is configured npm-side. - CLAUDE.md documents the one-off token publish for 1.0.0 and the OIDC switch. --- .github/workflows/ci.yml | 1 - CLAUDE.md | 5 +++-- README.md | 3 +-- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 188582a..ca5face 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,4 +24,3 @@ jobs: NPM_CONFIG_FILE: ${{ secrets.NPM_CONFIG_FILE }} NPM_PACKAGE_REGISTRY: ${{ secrets.NPM_PACKAGE_REGISTRY }} NPM_PACKAGE_PROXY_REGISTRY: ${{ secrets.NPM_PACKAGE_PROXY_REGISTRY }} - NPM_PACKAGE_REGISTRY_TOKEN: ${{ secrets.NPM_PACKAGE_REGISTRY_TOKEN }} diff --git a/CLAUDE.md b/CLAUDE.md index e0a4a32..384639c 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -4,7 +4,7 @@ Deep clone and deep freeze for JavaScript — prototype-aware. Preserves the pro ## Canonical rules -Global rules (`~/.claude/rules/*`) inherit automatically — tech-standards, writing, find-docs, git-conventions, privacy, overrides. The path-scoped `@~/.claude/rules/changelog.md` applies when editing `CHANGELOG.md`. Git-conventions divergences are stated inline in `## Rules` below. +Follows the Coroboros engineering global rules. Repo-specific divergences are stated inline in `## Rules` below. ## Tech Stack - TypeScript strict, ES modules + CJS dual build (tsdown) @@ -47,4 +47,5 @@ Global rules (`~/.claude/rules/*`) inherit automatically — tech-standards, wri - Run `pnpm lint && pnpm typecheck && pnpm test` before every commit. - Run `pnpm bench` against `bench/baseline.md` when touching `src/clone.ts` — no regression > 10 % at fixed feature set. - Scoped package — `publishConfig.access = "public"` is mandatory, do not remove. -- **Git** — branch `main`; CI owns `npm publish` exclusively (tag-push triggers `ci.yml` → reusable workflow `coroboros/ci/.github/workflows/javascript-npm-packages.yml@v0` → OIDC Trusted Publisher with `npm provenance`, never manual — manual bypasses attestation and the pre-publish gates); run `pnpm lint && pnpm typecheck && pnpm test && pnpm build` locally before tagging; tag MUST equal `package.json` version (the reusable workflow pins `package.json` to the tag automatically); bump via `pnpm version patch|minor`; release body in `gh release create` stays minimal (no install snippet unless the install command changed). All other rules in `@~/.claude/rules/git-conventions.md` apply. +- **Publish** — OIDC Trusted Publisher + `npm provenance`. `ci.yml` forwards no npm token; never re-add one. +- **Git** — `main`-only; branch → PR → squash-merge → tag the merge commit. The tag is the only manual step; release automation (version bump, `CHANGELOG.md`, npm publish, GitHub release) is owned by [`coroboros/ci`](https://github.com/coroboros/ci). Never hand-edit `package.json` version or `CHANGELOG.md`. Run `pnpm lint && pnpm typecheck && pnpm test && pnpm build` before tagging. diff --git a/README.md b/README.md index 7415d76..98735c7 100644 --- a/README.md +++ b/README.md @@ -9,9 +9,8 @@ Deep clones objects while preserving the prototype chain, property descriptors, boxed primitives, and native types (Map, Set, Date, RegExp, Error subclasses, TypedArray, DataView, ArrayBuffer, Buffer). Cycle-safe via a WeakMap visited cache. Deep-freezes recursively, skipping ArrayBuffer views. -[![ci](https://img.shields.io/github/actions/workflow/status/coroboros/clone/ci.yml?branch=main&style=flat-square&color=000000)](https://github.com/coroboros/clone/actions/workflows/ci.yml) [![npm](https://img.shields.io/npm/v/@coroboros/clone?style=flat-square&color=000000)](https://www.npmjs.com/package/@coroboros/clone) -[![branch](https://img.shields.io/badge/branch-stable-000000?style=flat-square)](https://github.com/coroboros/clone) +[![ci](https://img.shields.io/github/actions/workflow/status/coroboros/clone/ci.yml?branch=main&style=flat-square&label=ci&color=000000)](https://github.com/coroboros/clone/actions/workflows/ci.yml) [![license](https://img.shields.io/badge/license-MIT-000000?style=flat-square)](https://opensource.org/licenses/MIT) [![stars](https://img.shields.io/github/stars/coroboros/clone?style=flat-square&label=stars&color=000000)](https://github.com/coroboros/clone) [![coroboros.com](https://img.shields.io/badge/coroboros.com-000000?style=flat-square&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9IndoaXRlIiBzdHJva2Utd2lkdGg9IjIiIHN0cm9rZS1saW5lY2FwPSJyb3VuZCIgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCI+PGNpcmNsZSBjeD0iMTIiIGN5PSIxMiIgcj0iMTAiLz48cGF0aCBkPSJNMiAxMmgyME0xMiAyYTE1LjMgMTUuMyAwIDAgMSA0IDEwIDE1LjMgMTUuMyAwIDAgMS00IDEwIDE1LjMgMTUuMyAwIDAgMS00LTEwIDE1LjMgMTUuMyAwIDAgMSA0LTEweiIvPjwvc3ZnPg==)](https://coroboros.com)