REVIEW-OF-RECORD — APPROVE (#687, head b1a887a262). I reviewed the @next durable publish pipeline and found no blockers.
Publish guardrails: publish-next-npm is gated to push/manual on branch next and has a second in-step fatal guard requiring CI_COMMIT_BRANCH=next. The existing stable publish-npm remains on release tags and main push/manual package changes; it does not run on next. The next publish command uses pnpm publish ... --tag next and contains no latest-dist-tag operation, so next cannot update npm latest through this path. Main cannot publish @next because the publish-next-npm step is branch-gated away from main.
Versioning: prerelease versions are computed at publish time in the CI workspace from committed stable package versions as <patch+1>-next.<CI_PIPELINE_NUMBER>; no -next.* versions are committed in package.json. I simulated the version script with CI_PIPELINE_NUMBER=9999; it computed 23 publishable packages, including @mosaicstack/mosaic 0.0.48 -> 0.0.49-next.9999, then restored the worktree. The b1a887a2 brace fix is clean: the Node heredoc uses string concatenation rather than JS template literals that would collide with Woodpecker ${...} interpolation.
Secrets / tags / images: NPM_TOKEN reuses the existing Woodpecker gitea_token secret; no hardcoded credentials or new secret are introduced. Gateway image publishing on next is sha-only (gateway:sha-<short>); gateway:latest is added only under the main branch condition, and appservice/web image steps remain main/tag-only.
Reviewer verification on head b1a887a2: YAML parse pass; publish guard assertions pass; version-compute simulation pass; pnpm typecheck pass (41/41); pnpm lint pass (23/23); pnpm format:check pass; pnpm build pass (23/23). PR CI reported green on pipeline 1631. APPROVE.
REVIEW-OF-RECORD — APPROVE (#687, head b1a887a2627a10c72a65aaeba8b359d2ee0905da). I reviewed the @next durable publish pipeline and found no blockers.
Publish guardrails: `publish-next-npm` is gated to push/manual on branch `next` and has a second in-step fatal guard requiring `CI_COMMIT_BRANCH=next`. The existing stable `publish-npm` remains on release tags and main push/manual package changes; it does not run on `next`. The next publish command uses `pnpm publish ... --tag next` and contains no latest-dist-tag operation, so next cannot update npm `latest` through this path. Main cannot publish `@next` because the `publish-next-npm` step is branch-gated away from main.
Versioning: prerelease versions are computed at publish time in the CI workspace from committed stable package versions as `<patch+1>-next.<CI_PIPELINE_NUMBER>`; no `-next.*` versions are committed in package.json. I simulated the version script with `CI_PIPELINE_NUMBER=9999`; it computed 23 publishable packages, including `@mosaicstack/mosaic 0.0.48 -> 0.0.49-next.9999`, then restored the worktree. The b1a887a2 brace fix is clean: the Node heredoc uses string concatenation rather than JS template literals that would collide with Woodpecker `${...}` interpolation.
Secrets / tags / images: `NPM_TOKEN` reuses the existing Woodpecker `gitea_token` secret; no hardcoded credentials or new secret are introduced. Gateway image publishing on `next` is sha-only (`gateway:sha-<short>`); `gateway:latest` is added only under the `main` branch condition, and appservice/web image steps remain main/tag-only.
Reviewer verification on head b1a887a2: YAML parse pass; publish guard assertions pass; version-compute simulation pass; `pnpm typecheck` pass (41/41); `pnpm lint` pass (23/23); `pnpm format:check` pass; `pnpm build` pass (23/23). PR CI reported green on pipeline 1631. APPROVE.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Registry verification
Verification
No self-merge; release-config/SOURCE review requested.
e349ec6956tob1a887a262REVIEW-OF-RECORD — APPROVE (#687, head
b1a887a262). I reviewed the @next durable publish pipeline and found no blockers.Publish guardrails:
publish-next-npmis gated to push/manual on branchnextand has a second in-step fatal guard requiringCI_COMMIT_BRANCH=next. The existing stablepublish-npmremains on release tags and main push/manual package changes; it does not run onnext. The next publish command usespnpm publish ... --tag nextand contains no latest-dist-tag operation, so next cannot update npmlatestthrough this path. Main cannot publish@nextbecause thepublish-next-npmstep is branch-gated away from main.Versioning: prerelease versions are computed at publish time in the CI workspace from committed stable package versions as
<patch+1>-next.<CI_PIPELINE_NUMBER>; no-next.*versions are committed in package.json. I simulated the version script withCI_PIPELINE_NUMBER=9999; it computed 23 publishable packages, including@mosaicstack/mosaic 0.0.48 -> 0.0.49-next.9999, then restored the worktree. Theb1a887a2brace fix is clean: the Node heredoc uses string concatenation rather than JS template literals that would collide with Woodpecker${...}interpolation.Secrets / tags / images:
NPM_TOKENreuses the existing Woodpeckergitea_tokensecret; no hardcoded credentials or new secret are introduced. Gateway image publishing onnextis sha-only (gateway:sha-<short>);gateway:latestis added only under themainbranch condition, and appservice/web image steps remain main/tag-only.Reviewer verification on head
b1a887a2: YAML parse pass; publish guard assertions pass; version-compute simulation pass;pnpm typecheckpass (41/41);pnpm lintpass (23/23);pnpm format:checkpass;pnpm buildpass (23/23). PR CI reported green on pipeline 1631. APPROVE.