​

Trusted npm publishing for contributors

​

Publication contract

export type InvocationContext = Readonly<{
  repository: "ExpansionX/WednesdayAI-core";
  workflow: "npm-publish.yml";
  environment: "npm-publish";
  registry: "https://registry.npmjs.org/";
  ref: "refs/heads/main";
  sourceSha: string;
  mode: "stable" | "dev" | "recover";
  packages: readonly ["@wednesdayai/whatsapp", "wednesdayai"];
}>;

​

release-check

• name @wednesdayai/whatsapp
• not private
• repository git+https://github.com/ExpansionX/WednesdayAI-core.git
• extension entry ./dist/index.js
• runtime deps @whiskeysockets/baileys and qrcode-terminal

​

Identifiers and versions

​

What not to do

// Do not restore pack to the no-argument release check.
export function main(argv = process.argv.slice(2)) {
  if (argv.length === 0) {
    runNpmPack(); // rejected: Task 002 is static-only
  }
}

// Do this instead: no-argument path stays static.
export function main(argv = process.argv.slice(2)) {
  if (argv.length === 0) {
    checkPackageIdentity();
    checkPluginVersions();
    checkAppcastSparkleVersions();
    checkPluginSdkExports();
    return;
  }
}

• Adding npm publish or npm stage publish outside npm-publish.yml.
• Publishing a working directory instead of an exact sealed tarball.
• Administering stages or dist-tags through OIDC.
• Moving or reusing a release tag.
• Treating NPM_TOKEN as the long-term publisher. Traditional credentials remain only until live canaries pass.

​

Deployment artifact parity and vendoring

1. Prefer registry artifacts. For stable deployments, install wednesdayai@<X.Y.Z> (immutable once published). For main-adjacent commits, install the dev dist-tag and confirm the artifact was built from the intended commit: tar -xOf wednesdayai-<v>.tgz package/dist/build-info.json and check commit equals the full SHA you expect.
2. Otherwise vendor from the exact deployment commit. When no registry artifact matches (branch-built deployments), build at the pinned commit and record provenance:
   git checkout <full-sha>
   pnpm install --frozen-lockfile
   OPENCLAW_BUILD_CHANNEL=<stable|dev> pnpm build
   npm pack --json
   
   Record a provenance manifest: package name, canonical version, full source SHA, channel, tarball filename, integrity (sha512 from npm pack --json), size, and builtAt from dist/build-info.json. Pin downstream via the tarball path/URL plus its integrity — npm install <tarball> records the integrity in the lockfile, giving downstream pins the same immutability as a registry version. Docker source builds must pass GIT_COMMIT and OPENCLAW_BUILD_CHANNEL explicitly (.dockerignore excludes .git; an unset commit breaks provenance).
3. Contract. The npm-parity scheduled watchdog flags tags without registry counterparts and a stalled dev rail, but it cannot see untracked hand-built deployments — the vendoring manifest above is the only sanctioned form for those.

​

Related

• Release checklist
• How WednesdayAI updates reach you
• Release channels