fix(setup): allow anonymous UI installs and fork contributions

.github/dependabot.yml

@@ -1,27 +1,20 @@
 version: 2
 
-registries:
-  inkcre-github-packages:
-    type: npm-registry
-    url: https://npm.pkg.github.com
-    scope: '@inkcre'
-    token: ${{ secrets.INKCRE_PACKAGES_READ_TOKEN }}
-
 updates:
   - package-ecosystem: npm
     directory: /
     schedule:
       interval: weekly
     target-branch: main
-    registries:
-      - inkcre-github-packages
     open-pull-requests-limit: 3
     cooldown:
       default-days: 7
       semver-major-days: 30
       semver-minor-days: 7
       semver-patch-days: 3
     ignore:
+      # UI upgrades must adopt an already mirrored exact-version URL and lockfile together.
+      - dependency-name: '@inkcre/ui-web'
       - dependency-name: '*'
         update-types:
           - version-update:semver-major

.github/pull_request_template.md

@@ -5,6 +5,20 @@
 
 <!-- What changes, and why is this the smallest coherent change? -->
 
+<!-- Use type(scope): summary for the PR title; CONTRIBUTING.md owns stable scopes. -->
+
+Primary implementation scope:
+
+Affected release projects (or `none`):
+
+## Next action
+
+Feedback or acceptance needed:
+
+Person or team responding next:
+
+Outstanding delivery and blockers (link the tracking issue for cross-repository work):
+
 ## Validation evidence
 
 - [ ] `pnpm check`

.github/workflows/ci.yml

@@ -106,13 +106,9 @@ jobs:
         with:
           node-version-file: package.json
           cache: pnpm
-          registry-url: https://npm.pkg.github.com
-          scope: '@inkcre'
 
       - name: Install the frozen workspace
         run: pnpm install --frozen-lockfile
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: 校验 TS7、Vue 类型、静态规则及产物合同
         run: pnpm check
@@ -151,13 +147,9 @@ jobs:
         with:
           node-version-file: package.json
           cache: pnpm
-          registry-url: https://npm.pkg.github.com
-          scope: '@inkcre'
 
       - name: Install the frozen workspace
         run: pnpm install --frozen-lockfile
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install the exact browser engine
         run: pnpm exec playwright install --with-deps chromium
@@ -202,13 +194,9 @@ jobs:
         with:
           node-version-file: package.json
           cache: pnpm
-          registry-url: https://npm.pkg.github.com
-          scope: '@inkcre'
 
       - name: Install the frozen workspace
         run: pnpm install --frozen-lockfile
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install the exact browser engine
         run: pnpm exec playwright install --with-deps chromium

.github/workflows/core-sdk-release.yml

@@ -69,7 +69,6 @@ jobs:
     permissions:
       contents: read
       actions: read
-      packages: read
     runs-on: ubuntu-latest
     env:
       SOURCE_REVISION: ${{ needs.identity.outputs.source_revision }}
@@ -90,17 +89,13 @@ jobs:
         uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 11.11.0
-      - name: Configure workspace package access
+      - name: Set up workspace runtime
         if: needs.identity.outputs.artifact_id == ''
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: package.json
-          registry-url: https://npm.pkg.github.com
-          scope: '@inkcre'
       - name: Build and capture prebuilt SDK
         if: needs.identity.outputs.artifact_id == ''
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           pnpm install --frozen-lockfile
           pnpm --filter @inkcre/core build

.github/workflows/extension-release.yml

@@ -24,7 +24,6 @@ jobs:
     name: Reconcile first-party Extension release plan
     permissions:
       contents: write
-      packages: read
       pull-requests: write
     runs-on: ubuntu-latest
     outputs:
@@ -56,13 +55,9 @@ jobs:
         with:
           node-version-file: package.json
           cache: pnpm
-          registry-url: https://npm.pkg.github.com
-          scope: '@inkcre'
 
       - name: Install the frozen workspace
         run: pnpm install --frozen-lockfile
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       # The Version PR must open with an installation token: PRs created by the
       # default GITHUB_TOKEN never trigger CI (GitHub suppresses GITHUB_TOKEN
@@ -92,7 +87,6 @@ jobs:
     needs: reconcile
     permissions:
       contents: read
-      packages: read
       actions: read
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -126,13 +120,9 @@ jobs:
         with:
           node-version-file: package.json
           cache: pnpm
-          registry-url: https://npm.pkg.github.com
-          scope: '@inkcre'
 
       - name: Install the frozen release workspace
         run: pnpm install --frozen-lockfile
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Locate this run's saved release candidate
         id: saved
@@ -177,7 +167,6 @@ jobs:
     needs: candidate
     permissions:
       contents: read
-      packages: read
     runs-on: ubuntu-latest
     timeout-minutes: 20
     environment:
@@ -199,13 +188,9 @@ jobs:
         with:
           node-version-file: package.json
           cache: pnpm
-          registry-url: https://npm.pkg.github.com
-          scope: '@inkcre'
 
       - name: Install the frozen release workspace
         run: pnpm install --frozen-lockfile
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download this run's exact release candidate
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

.github/workflows/pages-deploy.yml

@@ -53,7 +53,6 @@ jobs:
     permissions:
       contents: read
       deployments: write
-      packages: read
     runs-on: ubuntu-latest
     timeout-minutes: 25
     environment:
@@ -79,14 +78,10 @@ jobs:
           node-version-file: release/package.json
           cache: pnpm
           cache-dependency-path: release/pnpm-lock.yaml
-          registry-url: https://npm.pkg.github.com
-          scope: '@inkcre'
 
       - name: Install the frozen release workspace
         working-directory: release
         run: pnpm install --frozen-lockfile
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build the exact-main release
         working-directory: release

.github/workflows/pages-preview.yml

@@ -11,7 +11,6 @@ on:
 
 permissions:
   contents: read
-  packages: read
 
 jobs:
   identity:
@@ -55,7 +54,6 @@ jobs:
     permissions:
       contents: read
       deployments: write
-      packages: read
     runs-on: ubuntu-latest
     timeout-minutes: 25
     environment:
@@ -87,8 +85,6 @@ jobs:
           node-version-file: candidate/package.json
           cache: pnpm
           cache-dependency-path: candidate/pnpm-lock.yaml
-          registry-url: https://npm.pkg.github.com
-          scope: '@inkcre'
 
       - name: Set up Python and PDM
         uses: pdm-project/setup-pdm@544d7237314ee09c256785bd360f6b30add38b37 # v4.6
@@ -104,7 +100,6 @@ jobs:
           pnpm install --frozen-lockfile
           pdm install --frozen-lockfile
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PDM_CHECK_UPDATE: 'false'
 
       - name: Build the exact-head SPA and Module Federation snapshots

CONTRIBUTING.md

@@ -0,0 +1,69 @@
+# Contributing
+
+The organization-wide Git and pull-request policy lives in
+[InKCre Git and GitHub Governance](https://github.com/InKCre/.github/blob/main/GOVERNANCE.md).
+This guide owns the `impl-ts` setup, monorepo boundaries, verification, and release-intent details
+required by that policy.
+
+## Public dependencies
+
+The lockfile downloads the original `@inkcre/ui-web` tarballs from public versioned GitHub Releases.
+Local clone and fork setup requires no organization membership, package access, or GitHub/npm token.
+Root overrides route exactly UI `2.3.0` and `2.5.0` to those assets; the integrity values remain those
+of the originally published packages.
+
+Keep workspace `package.json` UI dependencies as semver: Module Federation reads them as
+`requiredVersion`. Maintainers adopting a new UI version follow the
+[UI delivery contract](https://github.com/InKCre/ui/blob/main/CONTRIBUTING.md#public-package-delivery)
+to publish and anonymously verify its original tarball first, add its exact-version root override,
+and regenerate the lockfile. Verify a fresh frozen install and consumer builds with no token.
+Dependabot leaves UI upgrades to this coordinated step; other dependency updates remain automated.
+If a locked public URL fails, report its version and redacted response rather than adding credentials
+or switching the lockfile back to a private URL.
+
+## Setup
+
+Use Node.js 22.22.3 and pnpm 11.11.0, then run from the repository root:
+
+```bash
+git submodule update --init --recursive
+pnpm install --frozen-lockfile
+pnpm doctor
+pnpm check
+```
+
+`pnpm doctor` diagnoses the pinned toolchain. Use `pnpm dev` for the Web peer and read
+[`docs/40-deployment/development-runtime.md`](docs/40-deployment/development-runtime.md) before
+starting a database runtime, browser-extension lane, local Extension remotes, or joint UI source
+lane. Integration and E2E commands create or mutate development data; never point them at a shared
+development or production info-base.
+
+## Monorepo boundaries and change names
+
+- `apps/client-web/` and `apps/client-webext/` are independently delivered applications.
+- `packages/core/` and `packages/ext-dev-utils/` are shared packages.
+- Each `extensions/<id>/` is an independently versioned Module Federation distribution.
+
+Use the primary area as the `type(scope): summary` scope: `client-web`, `client-webext`, `core`,
+`ext-dev-utils`, or an Extension ID such as `twitter`. Use `extensions` for one coherent change
+spanning several Extensions and `release` for release tooling. The title does not select versions;
+list every affected release project in the pull-request body. Examples: `fix(client-web): retain peer
+selection`, `feat(twitter): show archived media`, and `ref(extensions): share host bootstrap`.
+
+For user-visible behavior or another delivered contract, run `pnpm changeset` and select the exact
+affected workspace projects. Do not edit generated versions or changelogs in a feature pull request.
+Pure contributor documentation or release-tooling changes do not invent package news. The
+[delivery contract](docs/40-deployment/native-extension-delivery.md) owns preparation, publication,
+and the distinction between applications, SDK packages, and native Extension releases.
+
+## Verification and pull requests
+
+Run `pnpm check` before opening or updating a pull request. Also run the behavior-level command that
+matches the change, normally `pnpm test:e2e:web`, `pnpm test:e2e:webext`, or a narrower documented
+acceptance command. Record what actually ran and any unmet environment condition in the pull-request
+body; a package build is not evidence of browser behavior.
+
+External fork workflows require maintainer approval and receive no preview or production credentials.
+A maintainer may perform a trusted Pages preview after the ordinary checks pass. Frozen dependency
+installation runs without an npm authentication token. Never add a credential to the branch to make
+a fork workflow run.

README.md

@@ -19,14 +19,19 @@ End users consume the published web build and browser extension through the depl
 
 ### Develop locally
 
+Read the [contribution guide](CONTRIBUTING.md) before installing. Locked UI packages download from
+public Release assets; local setup requires no organization package token.
+
 ```bash
 git submodule update --init --recursive
 pnpm install --frozen-lockfile
 pnpm run doctor
 pnpm dev
 ```
 
-`pnpm check` is the required format/lint/type/test/build gate used by CI. See the [organization contribution guide](https://github.com/InKCre/.github/blob/main/CONTRIBUTING.md) and [docs/40-deployment/development-runtime.md](docs/40-deployment/development-runtime.md) for the full local and SSH runtime contract.
+`pnpm check` is the required format/lint/type/test/build gate used by CI. See
+[docs/40-deployment/development-runtime.md](docs/40-deployment/development-runtime.md) for the full
+local and SSH runtime contract.
 
 ## Documentation
 

docs/40-deployment/native-extension-delivery.md

@@ -21,8 +21,13 @@ compatible SDK bump need not release MF consumers whose only generated change is
 propagation: they do not bundle Core (`import: false`) and keep their declared Host SDK range.
 Consumers that bundle changed code or require a newer minimum SDK must be released with it.
 
-Contributors record intent with `pnpm changeset`, selecting only affected independently releasable
-Extension packages. On a protected `main` push,
+Contributors record intent with `pnpm changeset`, selecting the affected versioned workspace
+projects: applications, SDK packages, or Extension packages. Private application and Extension
+packages are versioned too; `private` does not mean their release intent should be omitted.
+Changesets own versions and changelogs, while each delivery workflow owns its artifact. A package's
+commit or PR scope is not a substitute for selecting it in the Changeset.
+
+On a protected `main` push,
 [`.github/workflows/extension-release.yml`](../../.github/workflows/extension-release.yml) runs the
 **First-party Extension release** lifecycle: