Repository navigation
fix(release): ship code-aware retrieval through npm trusted publishing - #191
Merged
Merged
Conversation
The stored npm token expired, so semantic-release stopped at npm whoami with a 401 and every release from main failed. pnpm 11 exchanges the release job's GitHub OIDC identity for a short-lived npm token, so the workflow no longer passes NPM_TOKEN or writes a registry token file, and the release checks now require the job's id-token permission instead of a token. RELEASING documents the one-time trusted publisher entry on npmjs.com.
fix(release): publish to npm through trusted publishing
Release highlights: - Find code by file path and identifier: a question about login attempt throttling now reaches LoginAttemptService.java with the default offline provider. - Search up to 16 times faster: median search fell from 354 ms to 25 ms on a 21,546-chunk monorepo and from 202 ms to 15 ms on a 2,407-chunk repository. - Rank better by default: local-hash nDCG@10 rose by up to 35% on code and documentation, and semantic models gained up to 3%. - Upgrade without downtime: existing indexes keep answering while the next ingest rebuilds them. Release details: - **Ranking:** BM25 leads local-hash fusion; hashed vectors only break ties and backfill. - **Keyword index:** source paths and camelCase, acronym, and digit identifier parts join the full-text field, while embedded text stays unchanged. - **Search latency:** candidate pools follow the reciprocal-rank fusion bound, abstention is evaluated lazily in ranked order, and ranking memoizes row keys. - **Storage:** maintenance compacts tables from 64 small per-file fragments instead of waiting for 100,000 chunks. - **Upgrade:** a lexical policy version keeps older indexes searchable, doctor reports readiness.lexicalIndexCurrent, and ingest or upgrade stages a validated rebuild. - **Dependencies:** MCP SDK 1.31, mammoth 1.13, Astro 7.3.5 with @astrojs/react 7, and tooling updates; LanceDB stays on 0.30 so default installs keep the OpenAI and Transformers runtimes out. - **Release automation:** npm trusted publishing replaces the stored npm token, so releases authenticate with the workflow's GitHub OIDC identity. - **Documentation:** sharper READMEs with before-and-after benchmarks, plus updated configuration, CLI, migration, and release guides. Verification: - pnpm validate, pnpm offline:smoke, and the GitHub quality, commitlint, and code analysis checks. - Benchmarks on three code and documentation corpora with e5, mxbai, and local-hash: rankings equal or better, median search latency 13 to 16 times lower. - Browser check of the English and French landing pages after the React integration update. - Release checks pass with the job's OIDC identity, and a semantic-release dry run computed 6.1.0.
|
🎉 This PR is included in version 6.1.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix