Skip to content

docs: drop the 1.0 wording and the release workflow for now #434

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erkamyaman merged 1 commit into from
Oct 18, 2026
Merged

docs: drop the 1.0 wording and the release workflow for now #434

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@ name: E2E

# The slow end-to-end checks that do not fit a pull request: every panel view in a real browser,
# multi-tab and lifecycle resilience, and the install matrix from a packed tarball. Pull requests
# run the security and MCP checks (ci.yml), and the release runs a slice of the install matrix on
# the tarball it publishes (release.yml). See apps/docs/src/content/contributing/development.md.
# run the security and MCP checks (ci.yml), and a release can run a slice of the install matrix on
# its tarball. See apps/docs/src/content/contributing/development.md.
on:
schedule:
# Mondays at 07:00 UTC, an hour after latest.yml and compat.yml.
Expand Down
150 changes: 0 additions & 150 deletions .github/workflows/release.yml
View file
Open in desktop

This file was deleted.

10 changes: 2 additions & 8 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,8 @@

## Supported versions

Security fixes go to the 1.x release line of `@pangular-inspector/devtools`, in its latest
minor release. Versions before 1.0 are not supported: upgrade to the latest 1.x release to get a
fix.

| Version | Supported |
| ------- | --------- |
| 1.x | Yes |
| < 1.0 | No |
Pangular Inspector is in early development. Only the latest published release of
`@pangular-inspector/devtools` is supported. There are no older release lines to backport a fix to.

## Reporting a vulnerability

Expand Down
4 changes: 2 additions & 2 deletions apps/docs/src/content/agents/tools.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1013,9 +1013,9 @@ A server plugin adds tools named `plugin:<plugin id>:<tool>`, which your client

Use it for data that has no dedicated tool, such as hydration data and TransferState payloads (`pangular:http`, `pangular:http-payloads`) or live pipe usage (`pangular:pipe-usage`). See [Resources](./resources.md) for every key.

## Names before 1.0
## Renamed tools

Version 1.0 renamed tools and arguments so that each name follows one pattern: an optional library prefix (`ngrx-`, `redux-`, `tanstack-`, `capacitor-`, `analog-`), then a verb that says whether the tool reads source (`scan`), reads the page (`list`, `inspect`, `explain`, `lint`) or writes (`run`, `set`, `record`). The old names are not accepted.
Tools and arguments were renamed after 0.0.7 so that each name follows one pattern: an optional library prefix (`ngrx-`, `redux-`, `tanstack-`, `capacitor-`, `analog-`), then a verb that says whether the tool reads source (`scan`), reads the page (`list`, `inspect`, `explain`, `lint`) or writes (`run`, `set`, `record`). The old names are not accepted.

| Before | Now |
| ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
Expand Down
39 changes: 2 additions & 37 deletions apps/docs/src/content/contributing/publishing.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,46 +90,11 @@ This runs `pnpm --filter @pangular-inspector/devtools publish --access public`.
<code>pnpm publish</code> checks git before it publishes. Run it from a clean working tree on <code>main</code>.
</ngmd-alert>

## Releasing

Releases publish from CI, not from a laptop. `.github/workflows/release.yml` publishes the npm package with [provenance](https://docs.npmjs.com/generating-provenance-statements), so npm shows which commit and workflow built it.

<ngmd-workflow>
<ngmd-step title="Bump the version and write the changelog">
In one pull request, set <code>version</code> in <code>packages/devtools/package.json</code> and add a <code>## 1.2.3</code> section to <code>packages/devtools/CHANGELOG.md</code>. List every removed or renamed export, option and tool under Upgrade notes. Merge it to <code>main</code>.
</ngmd-step>
<ngmd-step title="Tag the merged commit">
Wait for CI to pass on that commit of <code>main</code>. Then run <code>git tag v1.2.3</code> on it and <code>git push origin v1.2.3</code>. The tag starts the workflow. To rerun a release, start <strong>Release</strong> from the <strong>Actions</strong> tab and pick the tag, not a branch, under <strong>Use workflow from</strong>.
</ngmd-step>
<ngmd-step title="Approve the npm environment">
The job runs in the <code>npm</code> environment, which holds the <code>NPM_TOKEN</code> secret. Approve it when the run asks.
</ngmd-step>
</ngmd-workflow>

The workflow stops at the first check that fails, before anything reaches npm:

1. The run is for a tag, and the tag is on `main`. The CI workflow (`ci.yml`) has a successful run on `main` for the tagged commit. The tag equals `v` plus the package version. The changelog has a non-empty section for that version (`scripts/release-notes.mjs`).
2. `pnpm typecheck`, `pnpm test:devtools` and `pnpm test:panel` pass.
3. `pnpm --filter @pangular-inspector/devtools pack` builds one tarball. The root `.pnpmfile.cjs` drops `devDependencies`, `scripts` and the `nx` block from the packed `package.json`.
4. `pnpm verify:publish` (Angular CLI and Analog) and a few cells of `pnpm e2e:install` install that exact tarball from a local registry into fresh apps, open them in Chromium and run the package audit.
5. `npm publish <tarball> --provenance --access public` publishes the same file. A version with a prerelease part, such as `1.3.0-rc.1`, goes to the `next` dist-tag; any other goes to `latest`.
6. `gh release create` makes the GitHub release, with the changelog section as its notes and the tarball attached.

The run keeps the tarball and the install reports as an artifact. To check a release candidate before you tag it, run the same steps locally:

```bash
pnpm --filter @pangular-inspector/devtools pack --pack-destination dist/release
pnpm verify:publish --tarball=dist/release/pangular-inspector-devtools-1.2.3.tgz
pnpm e2e:install --tarball=dist/release/pangular-inspector-devtools-1.2.3.tgz --cells=angular-cli:npm:22
```

`pnpm e2e:install` deletes its work folder when it ends, as it can reach several gigabytes. A failed run copies the logs out first and prints where they are. Pass `--keep` to keep the whole folder.

### The public API
## The public API

Each entry point exports only what these docs describe, and only that is covered by semver. The files in `packages/devtools/src/entries` choose those exports, and `public-api.test.ts` lists them, so a new export is a deliberate change. Code shared between the server, the overlay and the panel, such as most of `config.ts`, stays internal: the panel imports it as `@pangular-inspector/devtools/internal/config`, a workspace-only export that `publishConfig.exports` leaves out. Mark a declaration that has to be exported for the package's own modules with `@internal`, and the published types leave it out.

### Supported versions
## Supported versions

The Angular peer range has an upper bound, `>=12.2.0 <23.0.0`, because the overlay reads Angular's private debug APIs. Raise it in the release after the new major passes the [compatibility jobs](./development.md#angular-compatibility), and update the tested versions in [Installation](../getting-started/installation.md#tested-versions). `engines.node` is `>=22.12.0`, the first Node.js 22 that can `require()` the ES modules the Express hub loads.

Expand Down
2 changes: 1 addition & 1 deletion apps/docs/src/content/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ A refused code is never compared with the real one. devframe gives you a new cod

A browser that exchanges the code gets a session token, so it doesn't need the code again after a reload. The server keeps those tokens in `~/.pangular-inspector/auth/<project>/auth.json`, one folder per project (named after a hash of its path), so a token from one project doesn't open another project's server. The folder is readable by you only (mode `0700`), and the file too (`0600`). A token expires 7 days after the code was exchanged. To sign out every browser, delete the project's folder, or all of `~/.pangular-inspector/auth`, and restart the server.

Versions before 1.0 kept the tokens in `~/.devframes/devframe/auth.json` (the Express hub and the Vite plugin) or `~/.pangular/devframe/auth.json` (the CLI), readable by other users and without expiry. Pangular Inspector 1.0 doesn't read those files. Delete them if no other devframe tool uses them.
Version 0.0.7 and earlier kept the tokens in `~/.devframes/devframe/auth.json` (the Express hub and the Vite plugin) or `~/.pangular/devframe/auth.json` (the CLI), readable by other users and without expiry. Newer versions don't read those files. Delete them if no other devframe tool uses them.

### Express hub

Expand Down
Loading
Loading