publish-core

/publish-core - Publish Run402 Core packages to npm via OIDC

Trigger the canonical publish pipelines in this repo:

Package	Workflow	Tag
@run402/functions	.github/workflows/publish-functions.yml	v<version>-functions
@run402/release	.github/workflows/publish-release.yml	v<version>-release
@run402/runtime-kernel	.github/workflows/publish-runtime-kernel.yml	v<version>-runtime-kernel

These workflows own the full release lifecycle: version bump, lockfile update, build/test/smoke, OIDC-authenticated npm publish --provenance, version-bump commit-back to main, tag, GitHub release, and workflow summary.

Do not publish locally with npm publish. The trust model is npm Trusted Publisher: kychee-com/run402-core + main + the exact workflow filename.

When to publish

• @run402/functions: in-function helper API/types/runtime changed.
• @run402/release: ReleaseSpec canonicalization, materialization, diffing, schemas, or compatibility fixtures changed.
• @run402/runtime-kernel: public Core runtime contracts, capabilities, gateway-facing services, storage, functions, archive import/export, or adapter-facing behavior changed.

If @run402/functions or @run402/release changed and runtime-kernel should consume it, publish the dependency first, then commit a runtime-kernel dependency bump to the exact published version, then publish runtime-kernel.

Pre-flight

Run from the repo root.

1. Verify local main is exactly synced with origin/main:

   git branch --show-current
   git fetch origin main
   git rev-list --count HEAD..origin/main
   git rev-list --count origin/main..HEAD
   git status --short
   

   Stop if not on main, behind/ahead, or dirty. The workflow builds from origin/main; unpushed or uncommitted work would be invisible.

2. Run local checks:

   npm run lint
   npm run build
   npm test
   

3. Run relevant package smoke checks:

   npm run test:functions:smoke
   npm run test:release:smoke
   npm run core:boundary