[anilkreddy]

Summary

Establishes a private pnpm workspace containing two independent public ESM libraries: @commercekit-tools/notification-contract and @commercekit-tools/ccv2-client, both at intended source version 0.0.1.

Includes synthetic compatibility fixtures/adapters, type checks, installed-tarball tests, GitHub Packages configuration, guarded reservation/preview/stable publication workflows, a separate package Release workflow, CI, CodeQL, Dependabot and documentation. This repository is not a Marketplace Action and has no root action.yml.

Architecture

flowchart LR
  Notify --> Contract[notification-contract]
  Build --> Contract
  Deploy --> Contract
  Check[Future Check] --> Contract
  Workflows[Reusable workflows] --> Contract
  Build --> Client[ccv2-client]
  Deploy --> Client

Loading

The packages do not depend on one another and release independently. The initial requested integration version is 0.0.1, published through the preview channel under the preview dist-tag and marked as a GitHub prerelease. Stable 1.0 gates remain unchanged.

Package boundaries

The contract owns the v1 schema, exact known types, semantic validation, approved GitHub context extraction, distinct producer/notifier merge APIs, factories and focused sanitization. The client owns technical-user OAuth, memory token cache, injected transport, explicit safety policies, bounded responses and safe errors.

Provider rendering/delivery, Action inputs/outputs, result/summary disclosure, endpoint validation, polling, build/deployment lifecycle decisions, cancellation and traffic split stay local. No consumers, private monorepo or Sandbox were modified.

Compatibility

Current inspected baselines:

• Notify main: 015479e4340f61598d2125532acf6474381ca976 (v1 schema provenance).
• Build main: ebdc830161cf9122121ddeb137d005f375063997.
• Deploy open implementation PR feat: add CommerceKit Action Kit shared packages #1: 85baaaa01d114473cb662e2394e752e87a8f123d; starter main: 1373e409e1c388a094d3f49b20aea85f26b7bd91.

Seventeen provider-neutral fixtures cover Check, Build, Deploy, timeout-as-internal-error and prepare-canary handoff. Minimal Notify/Build/Deploy/future Check harnesses validate projection, context preservation, auth/policy integration, arrays and empty responses. The copied schema and embedded runtime schema have semantic parity tests. No consumer migration is included.

Retry safety

Every request requires an explicit policy. Token/safe-read permit bounded transient retries with Retry-After and jitter. Unsafe mutation never repeats network/timeout/429/5xx outcomes. Large Retry-After waits are chunked to avoid Node timer overflow. Exactly one 401 refresh/replay is permitted only on explicit consumer opt-in. Response bodies distinguish JSON (objects/arrays/primitives), empty and binary. Consumers retain endpoint validation and ambiguity classification.

Publishing

Manual main-only workflows require exact confirmations and immutable-version checks. Reservation packages are temporary unsupported 0.0.0-reserved.1 placeholders under reserved, never the actual implementation.

Phase 1 verifies the exact commit’s latest CI, all platform jobs, CodeQL analysis and security result against their expected official apps. It publishes exactly one selected package under preview or latest after quality/pack checks, using the tested tarball with SHA-256 verification and lifecycle scripts disabled. Phase 2 independently verifies registry presence, committed manifest, main ancestry, successful CI/CodeQL evidence and installed exports before creating a package-specific tag/Release. No moving major tags. Read-only check access is explicitly granted; package-manager caching is disabled in registry workflows. Recovery instructions avoid republishing immutable versions. No protected environment currently exists; owner configuration is documented.

Security

• No @actions/core / @actions/github dependency, credentials, telemetry or package logging.
• Memory-only tokens, injected secret masking, exact secret redaction, stack-free transport errors and bounded problem facts.
• HTTPS, blocked redirects, constrained base paths, abortable requests and bounded streams.
• Exact package pins and public source/tarball scanning.
• All external workflow Actions pinned to verified full SHAs; least permissions; no artifact uploads or pull_request_target.
• Public scanning is pattern-based defense in depth, with manual review still required for unknown secret/customer formats.

Validation

Local Node 24.21.0 / pnpm 12.6.0 / TypeScript 6.0.3 / Vitest 5.1.0:

• Frozen installation, formatting, lint and typecheck passed.
• pnpm test: 204 tests passed.
• pnpm test:coverage: statements 99.61%, branches 99.02%, functions 97.72%, lines 100%; independent 95% package thresholds passed.
• pnpm build, pnpm pack:check, pnpm scan:public, pnpm audit, pnpm quality passed.
• Both tarballs installed in temporary ESM consumers; public imports, schema export, declarations and internal export boundaries passed; temporary files removed.
• Workflow security and release/reservation guard tests passed without publication or registry calls.
• Dependency audit: no known vulnerabilities. Development minimatch override removes the glob amplification advisory pending upstream range updates.

The 0.0.1 release preparation passes local quality (204 tests). Final HEAD 7a1fde56fe66566cf7602d574ff301fb815a1eda passes CI quality, Ubuntu/Windows/macOS package checks, CodeQL analysis and the CodeQL security result. No live SAP/Sandbox scenarios were run.

Release status

No packages published. No package tags. No GitHub Releases.

Reservation/publication/release workflows were NOT EXECUTED. Consumer migrations, Sandbox scenarios, future Check Action, reusable workflows and coordinated Action releases remain later owner work. Do not merge or publish automatically.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.