fix(release): align the package-invariant and public-link gates

The invariant companion rule pinned @deepseek-ai/dsh-invariants to a ^0.0.1
peerDependency, which the workspace protocol replaces; it now requires
workspace:^ like every other workspace-internal reference.

The release note stated the provenance risk by naming the internal repository,
which the public-link gate rejects in tracked files. It now states the same
constraint without naming it.
This commit is contained in:
imccyu
2026-08-11 00:46:04 +08:00
parent a943e67798
commit bb489d1325
4 changed files with 6 additions and 6 deletions
+2 -2
View File
@@ -96,11 +96,11 @@ function checkManifest(
addViolation(violations, owner.manifestPath, 'files must publish lib/invariant.js')
}
if (owner.packageName === '@deepseek-ai/dsh-invariants') return
if (manifest.peerDependencies?.['@deepseek-ai/dsh-invariants'] !== '^0.0.1') {
if (manifest.peerDependencies?.['@deepseek-ai/dsh-invariants'] !== 'workspace:^') {
addViolation(
violations,
owner.manifestPath,
'@deepseek-ai/dsh-invariants must be a ^0.0.1 peerDependency',
'@deepseek-ai/dsh-invariants must be a workspace:^ peerDependency',
)
}
if (manifest.devDependencies?.['@deepseek-ai/dsh-invariants'] !== 'workspace:^') {