Refactor removal policy and harden CI npm auth by Jercik · Pull Request #21 · Jercik/worktree-remove

Jercik · 2026-05-01T11:15:46Z

Summary

centralize runtime removal decisions in RemovalPolicy and thread policy through CLI orchestration/removal flow
remove duplicated flag checks by moving auto-confirm and dirty-warning decisions behind policy methods
harden workflows for private registry installs by configuring npm.j4k.dev auth in checks, release, and dedupe workflows while documenting fork PR secret constraints
pin package publishing to the public npm registry with publishConfig
align README Node.js requirement with package.json engines

Test plan

Consolidate runtime removal flags into a shared policy module to simplify orchestration seams and improve maintainability. Configure the quality-checks workflow to inject NPM_TOKEN for npm.j4k.dev, then restore the managed oxlint-config-j4k setup used by this repository. Made-with: Cursor

github-actions

Summary: No issues found.

Code review by Code Review 1 (gpt-5.5)

github-actions

Summary: Found 1 info-level observation. Refactor preserves behavior; README and engines aligned correctly.

Code review by Code Review 2 (opus)

github-actions · 2026-05-01T12:21:50Z

          cache: "pnpm"

+      - name: Configure npm.j4k.dev auth
+        if: ${{ env.NPM_TOKEN != '' }}


ℹ️ Info: When NPM_TOKEN is missing/empty, this step silently skips and pnpm install --frozen-lockfile later fails with a cryptic registry auth error. The job-level if on line 13 already excludes fork PRs, so the only remaining case where NPM_TOKEN would be empty is a misconfigured repository secret — exactly when a fast, explicit failure helps the maintainer. release-npm.yml (lines 52–55) already does this with [ -z "${NPM_TOKEN}" ] && echo "NPM_TOKEN is required..." && exit 1. Consider matching that pattern here and in .github/workflows/dedupe-check.yml line 36 for consistency.

github-actions · 2026-05-01T12:28:24Z

🎉 This PR is included in version 1.4.2 🎉

The release is available on:

Your semantic-release bot 📦🚀

This comment has been minimized.

Sign in to view