ci: publish @wavehouse/sdk to npm and relicense to Apache-2.0 by EricAndrechek · Pull Request #266 · Wave-RF/WaveHouse

EricAndrechek · 2026-06-04T22:28:13Z

Summary

Makes @wavehouse/sdk consumable from npm, and relicenses the project MIT → Apache-2.0.

npm publishing (.github/workflows/publish-npm.yml, new) — the single npm trusted publisher for the SDK (npm allows one trusted workflow file per package), two jobs mirroring the Go/Docker release model: dev publishes 0.0.0-dev.<sha> under the dev dist-tag on every push to main that touches clients/ts/ (the npm analog of the :dev image), and release publishes a tagged version under latest/alpha/beta/rc/next (derived from the version) + a GitHub Release on sdk-v* tags, decoupled from the server's v* tags. Auth is GitHub OIDC trusted publishing — no NPM_TOKEN; --provenance is deferred until the repo is public. clients/ts/package.json gains author/homepage/bugs + a normalized repository.url and ships a bundled LICENSE. publish-dev.yml is unchanged apart from a pointer comment.
Relicense MIT → Apache-2.0 — permissive→permissive (Wave RF owns the copyright), adding an explicit patent grant. Both LICENSE files carry the canonical Apache text, a top-level NOTICE asserts the copyright, and every textual reference (README, CONTRIBUTING, SUPPORT, both Dockerfiles' OCI label, the docs hero/stat card, the JSON-LD license URL, the comparison table) flips.

@wavehouse/sdk@0.0.0-dev.0f8826c is already bootstrapped on npm and the OIDC trusted publisher is configured for publish-npm.yml, so merging arms the automated dev channel.

Test plan

make ci passes locally
actionlint clean on publish-npm.yml + publish-dev.yml
npm publish --dry-run builds via the package lifecycle and ships the Apache LICENSE + dist/ + README
No MIT license references remain (exhaustive grep)
First post-merge dev publish goes green via OIDC (verify after merge)

Related Issues

Closes #227
Refs #149

Re-asserts the Wave RF copyright that the MIT→Apache-2.0 relicense dropped (top-level NOTICE), and records the relicense + npm publishing under CHANGELOG [Unreleased] — the pre-push reviewer's two SHOULD findings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-06-04T22:28:32Z

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Free

Run ID: 529f1edf-653c-4e41-94e7-9975084709ac

📥 Commits

Reviewing files that changed from the base of the PR and between 0f8826c and 87a4feb.

📒 Files selected for processing (16)

.github/workflows/publish-dev.yml
.github/workflows/publish-npm.yml
CHANGELOG.md
CONTRIBUTING.md
LICENSE
NOTICE
README.md
SUPPORT.md
clients/ts/LICENSE
clients/ts/README.md
clients/ts/package.json
deployments/Dockerfile
deployments/Dockerfile.goreleaser
docs/src/components/Hero.astro
docs/src/content/docs/index.mdx
docs/src/content/docs/why-wavehouse.md

📝 Walkthrough

Summary by CodeRabbit

Chores
- Project relicensed from MIT to Apache 2.0; updated all license files, documentation, and package metadata accordingly.
New Features
- Automated npm publishing for the TypeScript SDK with separate development and stable release channels.

Walkthrough

This PR executes two major initiatives together: migrating the project license from MIT to Apache-2.0 repository-wide, and establishing automated npm publishing for the TypeScript SDK via GitHub Actions with OIDC trusted publishing. The license change affects legal documents, package metadata, and public-facing documentation. The npm publishing workflow automates snapshot builds on main and release builds from git tags, reading the version from package.json and creating matching GitHub Releases.

Changes

License Migration to Apache-2.0

Layer / File(s)	Summary
Core license files and legal documents `LICENSE`, `NOTICE`, `CONTRIBUTING.md`	License file replaced with full Apache-2.0 terms, new NOTICE file added with copyright statement, and contributor license attribution updated to Apache License 2.0.
Package and deployment metadata `clients/ts/package.json`, `clients/ts/LICENSE`, `clients/ts/README.md`, `deployments/Dockerfile`, `deployments/Dockerfile.goreleaser`, `README.md`	npm package repository metadata expanded; TypeScript client LICENSE populated with Apache-2.0; Docker image OCI license labels and README license sections updated.
Documentation and website updates `docs/src/components/Hero.astro`, `docs/src/content/docs/index.mdx`, `docs/src/content/docs/why-wavehouse.md`, `SUPPORT.md`, `CHANGELOG.md`	Hero component, homepage JSON-LD/stats, competitive comparisons, and support documentation updated to reflect Apache-2.0 license. Release notes document license change.

TypeScript SDK npm Publishing Automation

Layer / File(s)	Summary
GitHub Actions publishing workflow `.github/workflows/publish-npm.yml`	New workflow publishes `@wavehouse/sdk` to npm via OIDC trusted publishing. Dev job runs on `main` when `clients/ts/` changes and publishes snapshot as `0.0.0-dev.<sha>`. Release job runs on `sdk-v*` tags, validates tag matches package.json version, computes dist-tag from prerelease suffix, publishes to npm, and creates GitHub Release.
Workflow integration and documentation `.github/workflows/publish-dev.yml`, `CHANGELOG.md`	Comments clarify that TypeScript SDK publishes separately. Release notes document new OIDC-based automated publishing and related package metadata updates.

🎯 3 (Moderate) | ⏱️ ~20 minutes

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

jfwoods

LGTM

## Summary Follow-up to #266 — fixes the post-merge `dev` publish and redesigns the dev channel. The first post-merge `dev` run crashed on `npm install --global npm@latest`: ``` npm error code MODULE_NOT_FOUND npm error Cannot find module 'promise-retry' ``` `.nvmrc` pins Node 22, and setup-node resolved the **22.22.2** runner image whose bundled **npm 10.9.7 has a broken module tree** ([actions/runner-images#13883](actions/runner-images#13883), [nodejs/node#62430](nodejs/node#62430)) — so the self-upgrade crashed before ever reaching OIDC. Changes: 1. **Node 24 for the publish jobs** — ships **npm 11.5.1+** natively (the OIDC trusted-publishing floor), so the self-upgrade step is gone. The SDK build (tsup → es2022) is Node-version-agnostic; CI still tests on the repo's pinned Node 22. 2. **Content-addressed dev channel** — the `dev` job now builds on every push to `main` and publishes `0.0.0-dev.<build-hash>` only when that hash isn't already on npm. The version *is* a hash of the built `dist`, so an unchanged build maps to an existing version and is skipped — no `clients/ts` path guard (a build-affecting change outside `clients/ts` is caught too), and **no `workflow_dispatch`** (publishing can't be hand-fired). npm records the commit via `gitHead`. Synced with `main` (absorbs the `actions/checkout` v6.0.3 bump from #208). ## Test plan - [x] `make ci` passes locally - [x] `actionlint` clean - [x] Pre-push review `ship_it` — determinism verified by double-rebuild (identical hash) - [ ] After merge: the `dev` job publishes `0.0.0-dev.h<hash>` via OIDC (the first real trusted-publishing test) ## Related Issues Refs #227, #266 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…nks, make clean) Pre-push self-review (pre-push-reviewer + docs-reviewer) surfaced four fixable findings on this branch (the license MIT/Apache-2.0 contradiction is separate — it resolves when origin/main #266 merges in): - CHANGELOG: no [Unreleased] entry for the first-boot trial policy, the standalone-stack compose wiring, or the http_scheme doc catch-up from d7ee36e. Add an Added bullet (CHANGELOG is in the docs-prose denylist, so the docs gate can't catch this — the code reviewer did). - clients/ts/README.md: E2E path said `tests/sdk/` (actual: `tests/e2e/sdk/`), and the Development Guide + SDK API Reference links pointed at non-existent `../../docs/{development,sdk}.md` repo paths — also broken on npmjs.com where this README is published. Repoint to the live https://wavehouse.dev/ URLs. - development.md: `make clean` row omitted `docs/dist/`, which `make clean` removes (Makefile help and deployment.md already list it). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…merge Merging origin/main brought in the repo-wide MIT->Apache-2.0 relicense (#266), which flipped LICENSE, the README badge/text, the SDK README, the JSON-LD + stat card, and why-wavehouse. But two license mentions live in branch-authored prose that #266 never saw (added in this branch's launch-sharpening work), so the merge resolution kept them as "MIT-licensed": - README.md:124 (Project status blurb) - docs/src/content/docs/index.mdx:158 (homepage closer) Both now read "Apache-2.0-licensed", consistent with LICENSE/NOTICE and the rest of the docs. The remaining CHANGELOG "MIT" mentions are intentionally kept: the relicense entry itself and the genuinely-MIT external plugin packages. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

EricAndrechek and others added 2 commits June 4, 2026 18:06

move to apache 2.0 and final prep for npm publishing

8382a24

github-project-automation Bot added this to WaveHouse Task Board Jun 4, 2026

github-project-automation Bot moved this to Backlog in WaveHouse Task Board Jun 4, 2026

EricAndrechek requested a review from jfwoods June 4, 2026 22:32

EricAndrechek marked this pull request as ready for review June 4, 2026 22:32

EricAndrechek assigned jfwoods Jun 4, 2026

github-actions Bot assigned taitelee Jun 4, 2026

github-actions Bot requested a review from taitelee June 4, 2026 22:32

EricAndrechek removed the request for review from taitelee June 4, 2026 22:32

jfwoods approved these changes Jun 4, 2026

View reviewed changes

github-project-automation Bot moved this from Backlog to In progress in WaveHouse Task Board Jun 4, 2026

EricAndrechek merged commit 21908f2 into main Jun 4, 2026
11 of 12 checks passed

EricAndrechek deleted the npm-publishing branch June 4, 2026 22:41

github-project-automation Bot moved this from In progress to Done in WaveHouse Task Board Jun 4, 2026

EricAndrechek mentioned this pull request Jun 4, 2026

fix(ci): publish SDK on Node 24 (Node 22.22.2 npm upgrade broken) #267

Merged

4 tasks

EricAndrechek mentioned this pull request Jun 4, 2026

npm publishing: post-launch follow-ups (provenance, release path, latest tag, docs) #268

Closed

4 tasks

EricAndrechek mentioned this pull request Jun 5, 2026

release: cut v0.1.0 (first public release) #149

Closed

31 tasks

Navigation Menu

Uh oh!

ci: publish @wavehouse/sdk to npm and relicense to Apache-2.0 - #266

ci: publish @wavehouse/sdk to npm and relicense to Apache-2.0#266
EricAndrechek merged 2 commits into
mainfrom
npm-publishing

EricAndrechek commented Jun 4, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jun 4, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

jfwoods left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

EricAndrechek commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Related Issues

Uh oh!

coderabbitai Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

jfwoods left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

EricAndrechek commented Jun 4, 2026 •

edited

Loading

coderabbitai Bot commented Jun 4, 2026 •

edited

Loading