esengine 4111108fc4 ci(release): attest and gate the CLI channels job ...

cli-channels runs in the studio-cli-channels environment and is the only job
with id-token: write. Its registry tokens are environment-only secrets
(STUDIO_NPM_TOKEN, STUDIO_HOMEBREW_TAP_TOKEN), and its first step fails unless
the environment has a required reviewer. npm publish passes --provenance,
matching the 1.x release line. A contract test parses every workflow and pins
the permissions, the secret references and the id-token grant. npm/ changes now
trigger the CI job that runs npm/publish.test.mjs.

2026-09-30 00:49:28 -07:00

..

reasonix

feat(release): npm + Homebrew distribution for the CLI (#2775)

2026-06-02 09:01:02 -07:00

build.mjs

refactor: the kernel's packages live in the layer they belong to

2026-09-23 18:28:21 -07:00

publish.mjs

ci(release): attest and gate the CLI channels job

2026-09-30 00:49:28 -07:00

publish.test.mjs

ci(release): attest and gate the CLI channels job

2026-09-30 00:49:28 -07:00