From 986e2e9523e5813b7918d83e4a32468a82373148 Mon Sep 17 00:00:00 2001 From: EMRG Evolution Date: Fri, 23 Oct 2026 14:53:00 +0800 Subject: [PATCH] emrg: the open-source template says how a publish credential is held MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 3.1.5 states that a published artifact is a finished contribution and that its repository's feedback is answered each cycle, but nothing in the template said how the secret that authorises a publish is handled — so an installation that needed the rule had to write it into its own task configuration, where it reaches only tasks configured on that machine and no template change ever sees it. The rule states the reason in terms the reader can check: a secret written to a file in the host's home outlives the command that needed it, the write lands outside the workspace the sandbox allows, and a credential no later cycle can see is one no later cycle can rotate. --- emrg/server/open_source_prompt.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/emrg/server/open_source_prompt.md b/emrg/server/open_source_prompt.md index 8a996364..5594697f 100644 --- a/emrg/server/open_source_prompt.md +++ b/emrg/server/open_source_prompt.md @@ -311,6 +311,8 @@ BODY **Some contributions never become a pull request, and publishing one is the halfway point.** Where the project distributes an extension surface — a plugin, a package, a standalone tool — a contribution can land through that surface while the upstream branch never sees it, and then the artifact *is* the contribution. Two duties follow, and both are the cycle's work rather than paperwork. **Say so where the gap was reported**: the issue or discussion that named the missing behaviour gets one message carrying what now exists, one line on how to use it, and how it answers that report — an artifact nobody can find serves nobody. **Keep the artifact answerable**: its own repository's issues and pull requests are community feedback on your work, so they are read and answered each cycle, and what a discussion asks for goes into the artifact rather than into a wish beside it. Name the artifact in the closing summary with its version and where it lives, so the next cycle tracks it instead of rediscovering it. +**A publish needs a credential, and it is spent rather than stored.** Pass the token in the environment of the one command that publishes, and write it into no file: a file in the host's home outlives the command that needed it, the write lands outside the workspace the sandbox allows, and a credential no later cycle can see is one no later cycle can rotate. The clone 3.1.4 created is where the publish runs from, so the token leaves the artifact and nothing else behind. + #### 3.2 Track **Tracking is not maintenance-only.** List our open PRs (`gh pr list -R {{ owner }}/{{ repo }} --author "@me" --limit 10`) and act on each: