feat(release): publish npm nightly snapshots

[M4n5ter]

English

Summary

• Keep exactly two npm channels: approved stable releases advance latest; developer snapshots advance nightly. There is no next or product prerelease path.
• Restrict npm OIDC publication to reviewed main workflow code. Formal publication treats v<version> as verified product data, builds it in jobs without OIDC, and lets only the trusted main publisher submit the validated tarball to npm staging.
• Make GitHub run_number the single Nightly ordering authority. Nightly versions use 0.2.0-dev.<run>.<date>, and both npm and Desktop reject any attempt to move their mutable channel backwards.
• Validate the one tarball actually produced by the build, including Nightly versions, instead of deriving a stable tarball name from the checked-in manifest.
• Hand only the exact published version from npm to Desktop. The authenticated workflow_run event already owns the repository, run, and source commit.
• Keep npm and Desktop lifecycle ownership separate: npm-publication.yml owns npm, desktop-nightly.yml owns Desktop Nightly, and the formal product release workflow owns stable Desktop releases.
• Pin packaged Desktop remote Runtime Host setup to the exact npm Nightly version rather than a mutable dist-tag.

Verification

• npm run check:release — 127 tests passed
• Focused Nightly, publication, workflow-policy, and product-release suites — 70 tests passed
• npm run lint
• npm run format:check
• npm run typecheck
• git diff --check

Rollout

After merge, wait for .asf.yaml to reconcile the npm-publication Environment. It admits only main and intentionally has no GitHub reviewer gate so scheduled Nightly publication can run automatically.

Configure the single maka-agent npm Trusted Publisher as:

• workflow: npm-publication.yml
• environment: npm-publication
• allowed actions: npm publish and npm stage publish

These are repository variables, not workflow inputs. Create them under Settings → Secrets and variables → Actions → Variables, or enable npm Nightly with:

gh variable set NPM_NIGHTLY_ENABLED --repo apache/maka --body true

Then dispatch npm publication from main with channel=nightly and verify the exact public version plus the nightly dist-tag. Keep token publication disabled.

npm Nightly does not depend on Desktop Infra. After the existing Nightlies rsync setup and signing secrets are ready, enable Desktop Nightly with:

gh variable set DESKTOP_NIGHTLY_ENABLED --repo apache/maka --body true

Then start a fresh npm Nightly; its successful run triggers Desktop Nightly with the version-only artifact.

Leave latest absent until the first approved stable release. Nightly advances only nightly.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented and verified the workflow boundaries, publication ordering, packaging validation, release-contract tests, and bilingual runbooks.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck, and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

概要

• npm 只保留两个渠道：获批的稳定版本推进 latest，开发快照推进 nightly；不再存在 next 或产品预发布路径。
• npm OIDC 发布权限只交给 main 上已审查的工作流代码。正式发布仅把 v<version> 当作已验证的产品数据，在无 OIDC 的任务中完成构建；只有受信任的 main 发布器可以把验证后的 tarball 提交到 npm staging。
• 以 GitHub run_number 作为 Nightly 唯一的顺序权威。Nightly 版本格式为 0.2.0-dev.<run>.<date>；npm 与 Desktop 都会拒绝让可变渠道倒退的发布。
• 验证构建实际产生的唯一 tarball，包括 Nightly 版本；不再根据仓库 manifest 中的稳定版本推导 tarball 文件名。
• npm 与 Desktop 之间只传递精确的已发布版本。仓库、run 与 source commit 已由可信的 workflow_run event 提供。
• 分离 npm 与 Desktop 的生命周期权威：npm-publication.yml 负责 npm，desktop-nightly.yml 负责 Desktop Nightly，产品正式发布工作流负责稳定版 Desktop。
• 打包后的 Desktop 固定使用精确的 npm Nightly 版本安装远程 Runtime Host，不依赖可变 dist-tag。

验证

• npm run check:release——127 项测试通过
• Nightly、publication、workflow-policy 与产品发布 focused suites——70 项测试通过
• npm run lint
• npm run format:check
• npm run typecheck
• git diff --check

上线步骤

合并后，等待 .asf.yaml 同步出 npm-publication Environment。它只允许 main；为保证定时 Nightly 自动运行，它有意不设置 GitHub reviewer gate。

将 maka-agent 唯一的 npm Trusted Publisher 配置为：

• workflow：npm-publication.yml
• environment：npm-publication
• allowed actions：npm publish 与 npm stage publish

它们是 repository variable，不是 workflow input。可以在 Settings → Secrets and variables → Actions → Variables 中创建，或先用下面的命令启用 npm Nightly：

gh variable set NPM_NIGHTLY_ENABLED --repo apache/maka --body true

然后从 main dispatch npm publication 并选择 channel=nightly，验证公共 Registry 中的精确版本与 nightly dist-tag。继续禁用 token publication。

npm Nightly 不依赖 Desktop Infra。现有 Nightlies rsync 配置与签名 secrets 就绪后，用下面的命令启用 Desktop Nightly：

gh variable set DESKTOP_NIGHTLY_ENABLED --repo apache/maka --body true

然后启动一次新的 npm Nightly；成功的 npm run 会通过只包含版本的 artifact 触发 Desktop Nightly。

在第一个获批稳定版发布前保持 latest 不存在。Nightly 只推进 nightly。

AI 使用

• 没有生成式工具作出实质性贡献
• 生成式工具作出了实质性贡献

工具与范围：OpenAI Codex 实现并验证了工作流边界、发布顺序、打包验证、发布契约测试和双语 runbook。

Checklist

• 测试覆盖本次变更，并且在缺少对应实现时会失败
• lint、format、typecheck 与受影响测试均已在本地通过

该 PR 是否会改变行为？

• 是——已在上述概要中说明
• 否

[Astro-Han]

Thanks for taking on this release boundary. The overall ownership model is strong: OIDC remains limited to reviewed main workflow code, build jobs do not receive publication credentials, the Desktop handoff carries an exact version tied to the triggering run and source SHA, and Nightly remains clearly separate from an approved ASF source release.

I left one inline P1 on version ordering. The current implementation works while every Nightly shares the checked-in product version, but it deterministically prevents both npm and Desktop Nightly from advancing after the product version changes. This can be fixed without adding another state or ordering authority.

Reviewed with Codex and two independent deep-review agents. I verified the exact head, OIDC and artifact provenance, npm/Desktop lifecycle ownership, ASF source-release boundary, version ordering, and focused release contracts. I did not find another blocking provenance or architecture issue.

中文对照

谢谢你处理这个发布边界。整体职责模型是清晰的：OIDC 只交给 main 上经过审查的 workflow，构建任务不会获得发布凭据，Desktop 交接的是与触发 run 和 source SHA 绑定的精确版本，Nightly 也与经过批准的 ASF 源码发布保持了明确区分。

我在版本排序边界留了一条 P1 行内评论。当前实现只在已发布 Nightly 与仓库中的产品版本一致时有效；产品版本升级后，npm 和 Desktop Nightly 都会确定性地停止推进。这个问题不需要增加新的状态或排序 authority 就能修复。

本次审查使用了 Codex 和两个独立的深度审查子代理；我核对了精确 head、OIDC 与 artifact provenance、npm/Desktop 生命周期职责、ASF 源码发布边界、版本排序和针对性发布契约。除此之外，没有发现其他阻塞性的 provenance 或架构问题。

[Astro-Han]

Thanks for addressing this. I verified that the published Nightly is now parsed independently of the checked-in product version, while the candidate is still required to belong to the current product version. The globally monotonic run number remains the single ordering authority, without adding separate npm or Desktop compatibility state.

The cross-product-version case passes at the shared boundary, and the current test, package, and platform validation checks are green. The original P1 is resolved; I found no remaining blocking issue.

Reviewed with OpenAI Codex as an AI-assisted review; I verified the shared ordering implementation, npm and Desktop call paths, focused cross-version coverage, and current CI results.

中文对照

谢谢你处理这个问题。我确认了当前实现会独立解析已经发布的 Nightly，同时仍要求候选版本属于仓库中的当前产品版本。全局单调递增的 run number 仍然是唯一的排序 authority，没有为 npm 或 Desktop 增加额外的兼容状态。

跨产品版本的用例已在共享边界通过，当前 test、package 和各平台验证也都是绿色。原来的 P1 已解决，没有发现剩余的阻塞问题。

本次审查由 OpenAI Codex 辅助完成；我核对了共享排序实现、npm 与 Desktop 调用路径、跨版本定向测试和当前 CI 结果。