NPM Publishing & Continuous Integration
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
Delano utilizes npm as its primary distribution surface, providing a CLI and runtime for agent-agnostic delivery contracts. The publishing process is deeply integrated with GitHub Actions to ensure that the distributed package is technically accurate, privacy-safe, and synchronized with the repository's source of truth. Continuous Integration (CI) in Delano encompasses automated asset building, schema validation, and drift detection between the package manifest and the actual filesystem payload.
Sources: README.md:162-163, README.md:290-291, package.json:2-15
Build and Asset Pipeline
The project uses a structured pipeline to transform source artifacts into a deployable npm package. A critical step in this pipeline is the build:assets script, which stages generic context templates into the payload to prevent repo-specific data from leaking into consumer installations.
Payload Generation Flow
The CI process ensures that the assets/payload/ directory is correctly populated before any distribution occurs.
The diagram shows the sequence of preparing the package payload, emphasizing the transition from source templates to a clean distribution state.
Sources: package.json:23, test/package.test.js:68-75, AGENTS.md:23-28
Build Scripts and Configuration
| Script Name | Command | Purpose |
|---|---|---|
build:assets | node scripts/build-npm-assets.mjs | Rebuilds the packaged runtime assets from templates. |
prepack | npm run build:assets | Automatically ensures assets are built before npm pack or npm publish. |
check:package-manifest | node scripts/check-package-manifest-drift.mjs | Verifies the install-manifest.json matches the actual payload. |
Sources: package.json:23-26, README.md:309-312
Publishing Workflow
Delano employs "Trusted Publishing" via GitHub Actions and OpenID Connect (OIDC). This mechanism removes the need for long-lived npm tokens and validates the repository URL against the provenance bundle.
Automation via GitHub Actions
The workflow is defined in .github/workflows/publish-npm.yml. It is triggered by pushing a version tag (e.g., v0.2.4) or by manual dispatch from the main branch.
This sequence illustrates the automated steps from code push to successful registry publication.
Sources: README.md:300-315
Distribution Safety Requirements
For a release to be considered ready, the following conditions must be met:
- Registry URL: The
package.jsonmust haverepository.urlset to `https://github.com/MajesteitBart/delano%60. - Permissions: The GitHub Actions workflow must have
id-token: writepermissions. - Drift Check: The package contents must exactly match the
assets/install-manifest.json.
Sources: package.json:7-10, README.md:303-315, test/package.test.js:106-112
Continuous Integration & Validation
The CI suite goes beyond standard unit testing, incorporating specialized checks for the Delano runtime and delivery model.
Validation Categories
Validation is handled by both npm test and specific PM scripts located in .agents/scripts/pm/.
- Package Integrity: Ensuring Git config files (like
.gitignore) are excluded from the npm payload to avoid interfering with target repository configurations. - Schema Validation: Checking artifact schemas, status transitions, and operating modes.
- Privacy & Safety: Verifying that logs are privacy-safe and that no local absolute paths leak into the distributed artifacts.
- Runtime Health: Checking worktree health, lease contracts, and sync maps.
Sources: README.md:275-288, test/package.test.js:15-30, package.json:27-55
Key CI Check Scripts
| Path | Purpose |
|---|---|
scripts/check-text-safety.mjs | Rejects bidi control characters and other text-based security risks. |
scripts/check-artifact-schemas.mjs | Ensures all scoped artifacts have valid JSON schemas. |
scripts/check-status-transitions.mjs | Validates lifecycle movements (e.g., preventing "done" status while project is "planned"). |
scripts/check-log-safety.sh | Ensures committed logs do not contain raw sensitive prompts. |
Sources: package.json:30-50, test/package.test.js:150-165, AGENTS.md:43-45
Conclusion
The NPM Publishing and CI systems in Delano are designed to maintain the "Local Dossier" product posture while ensuring high-integrity distribution. By enforcing strict manifest drift checks, using OIDC for trusted publishing, and staging generic templates to protect repository-specific context, the project provides a reliable and secure installation path for coding agents and human operators alike.
Sources: README.md:40-45, README.md:300-318