@ondeinference / onde / commits / d085916

Write the 1.2.5 changelog and fix the release skill's npm docs

The version bump was already done. All ten sources in the release checklist carry 1.2.5, and the publish dry-run packages cleanly. The root changelog was the one thing left, because it is not on that checklist and nothing in CI validates it, so it still ended at 1.1.1. The entry covers what landed since 1.2.4: engine-level tool-calling capability detection and tool-result recording, both Rust-only and absent from the UniFFI surface, plus the npm workflow moving to OIDC trusted publishing. That move left the skill wrong. It still told you to create an NPM_TOKEN and listed a rotation step for a secret the workflow no longer reads. Replaced with what OIDC actually needs, including the symptom when the trusted publisher and the job disagree: npm answers with a 404 on PUT, which reads like a missing package rather than an auth failure and sends you looking in the wrong place. Added the root changelog to the checklist as step 11 so the next release does not skip it again. Still missing: 1.1.2 through 1.2.4, eighty-seven commits nobody wrote up. Left as a hole rather than reconstructed from git log after the fact. Co-Authored-By: siGit Code <noreply@sigit.si>

Seto Elkahfi committed Sep 10, 2026 at 18:33 UTC d085916e5a3145f6df96ef88ad593293d9abef22

2 files changed +45 -9

.agents/skills/sdk-releases/SKILL.md

+25 -9

@@ -40,6 +40,7 @@ in a single commit before tagging.**

45 ### Files you do NOT manually edit

@@ -58,13 +59,14 @@ in a single commit before tagging.**

59 # 5. Edit sdk/react-native/rust/Cargo.toml version (manual)

60 # 6. Prepend new section to sdk/react-native/CHANGELOG.md (manual)

61 # 7. Edit sdk/kotlin/gradle.properties VERSION_NAME (manual)

62 +# 8. Prepend new section to CHANGELOG.md at the repo root (manual)

62 -# 8. Sync lockfiles

64 +# 9. Sync lockfiles

65 cargo check # updates root Cargo.lock

66 cd sdk/dart/rust && cargo update -p onde # updates Dart SDK's Cargo.lock

67 cd sdk/react-native/rust && cargo update -p onde # updates React Native SDK's Cargo.lock

67 -# 9. Verify

69 +# 10. Verify

70 grep '^version' Cargo.toml # "0.1.3"

71 grep '^version:' sdk/dart/pubspec.yaml # 0.1.3

72 grep '"version"' sdk/react-native/package.json # "0.1.3"

@@ -74,7 +76,7 @@ grep 'name = "onde"' -A1 Cargo.lock # version = "0.1.3"

76 grep 'name = "onde"' -A1 sdk/dart/rust/Cargo.lock # version = "0.1.3"

77 grep 'name = "onde"' -A1 sdk/react-native/rust/Cargo.lock # version = "0.1.3"

77 -# 10. Commit and tag

79 +# 11. Commit and tag

80 git add -A

81 git commit -m "0.1.3"

82 git tag 0.1.3

@@ -243,10 +245,23 @@ The publish step checks `npm view <package>@<version>` before publishing. If the

245 version already exists, it **skips** with a success exit code. This makes the npm

246 workflow safe to re-run — unlike Dart/Rust, it won't fail on a duplicate version.

247

246 -### Required secret

248 +### No secret: trusted publishing

249 +

250 +Since 1.2.5 the npm workflow publishes over OIDC rather than a long-lived token,

251 +so there is no `NPM_TOKEN` to rotate. Two things have to line up instead:

252 +

253 +- The `publish` job declares `permissions: id-token: write`.

254 +- The trusted publisher on

255 + npmjs.com/package/@ondeinference/react-native/access names repo

256 + `ondeinference/onde`, workflow `release-sdk-npm.yml`, and no environment.

257 +

258 +If those drift apart, npm answers the publish with a 404 on PUT rather than an

259 +auth error, which reads as a missing package and sends you looking in the wrong

260 +place. Adding an `environment:` to the job without setting the matching

261 +Environment name field on that npm page is the usual way to cause it.

262

248 -`NPM_TOKEN` — a granular npm access token scoped to the `@ondeinference` org

249 -with read+write packages. Create at npmjs.com → Access Tokens.

263 +The job also upgrades npm before publishing: Node 22 ships npm 10, and trusted

264 +publishing needs 11.5.1 or newer.

265

266 ---

267

@@ -332,7 +347,6 @@ All four must match. If any pair diverges, the relevant CI job fails.

347 | `CARGO_REGISTRY_TOKEN` | `release-sdk-rust.yml` | Authenticate with crates.io for `cargo publish`. Scoped to `publish-update` for the `onde` crate. Create at https://crates.io/settings/tokens. |

348 | `ONDE_SWIFT_PAT` | `release-sdk-swift.yml` | Push commits + tags to `ondeinference/onde-swift`. Must be a PAT (not `GITHUB_TOKEN`) so it triggers workflows on `onde-swift`. Needs `contents: write` scope. |

349 | `PUB_CREDENTIALS` | `release-sdk-dart.yml` | Authenticate with pub.dev for `flutter pub publish`. Full JSON from `~/.config/dart/pub-credentials.json`. |

335 -| `NPM_TOKEN` | `release-sdk-npm.yml` | Authenticate with npm for `npm publish`. Granular access token scoped to the `@ondeinference` org with read+write packages. Create at npmjs.com → Access Tokens. |

350 | `ORG_GRADLE_PROJECT_MAVENCENTRALUSERNAME` | `release-sdk-kotlin.yml` | Sonatype Central Portal token username. Generate at central.sonatype.com → Profile → Generate User Token. |

351 | `ORG_GRADLE_PROJECT_MAVENCENTRALPASSWORD` | `release-sdk-kotlin.yml` | Sonatype Central Portal token password. Same dialog as above. |

352 | `ORG_GRADLE_PROJECT_SIGNINGKEYID` | `release-sdk-kotlin.yml` | Last 8 chars of GPG key fingerprint used to sign Maven Central artifacts. |

@@ -357,12 +371,13 @@ All four must match. If any pair diverges, the relevant CI job fails.

371 | Forgot to update `sdk/react-native/rust/Cargo.lock` | npm SDK's Rust bridge builds against stale `onde` version | Run `cd sdk/react-native/rust && cargo update -p onde` |

372 | Forgot to update `sdk/dart/CHANGELOG.md` | pub.dev shows stale changelog | Prepend new `## 0.1.3` section before tagging |

373 | Forgot to bump `sdk/react-native/CHANGELOG.md` | npm shows stale changelog | Prepend new `## 0.1.3` section before tagging |

374 +| Forgot to update the root `CHANGELOG.md` | No CI failure at all, the file just goes stale silently | Prepend the new section before tagging. Nothing validates this one, so it is the easiest to miss |

375 | Forgot to bump `sdk/kotlin/gradle.properties` `VERSION_NAME` | Kotlin CI fails: tag vs gradle.properties mismatch | Bump `VERSION_NAME`, amend commit, re-tag |

376 | Tag has `v` prefix (`v0.1.3`) | CI does not trigger — tag pattern requires bare semver | Delete the tag, re-tag without `v` |

377 | `CARGO_REGISTRY_TOKEN` missing | `cargo publish` fails with auth error | Create a scoped token at crates.io/settings/tokens, add as repo secret |

378 | `ONDE_SWIFT_PAT` expired | `onde-swift` push fails with 403 | Regenerate PAT at github.com/settings/tokens, update repo secret |

379 | `PUB_CREDENTIALS` expired | `flutter pub publish` fails with 401 | Run `dart pub login` locally, copy new credentials JSON to repo secret |

365 -| `NPM_TOKEN` expired | `npm publish` fails with 401/403 | Regenerate token at npmjs.com → Access Tokens, update repo secret |

380 +| npm trusted publisher does not match the workflow | `npm publish` fails with a 404 on PUT, not a 401 | Check repo, workflow filename, and environment on npmjs.com/package/@ondeinference/react-native/access against what the `publish` job declares |

381 | crates.io version already published | `cargo publish` fails with "already uploaded" | crates.io is immutable — bump to next version. `cargo yank` hides but doesn't delete. |

382 | npm version already published | npm publish step skips (idempotency guard) | Safe — the workflow exits 0. No action needed. |

383 | pub.dev version already published | `flutter pub publish` fails | pub.dev is immutable — bump to next version |

@@ -434,7 +449,8 @@ npm run build

449 npm publish --access public

450 ```

451

437 -Requires `npm login` or `NPM_TOKEN` env var.

452 +Requires `npm login`. Trusted publishing is CI-only, so a manual publish falls

453 +back to your own npm credentials.

454

455 ### When to use manual publish

456

CHANGELOG.md

+20

@@ -1,3 +1,23 @@

1 +## 1.2.5

2 +

3 +### Tool calling (Rust-native only)

4 +

5 +* `ChatEngine::tool_calling_support()` reports whether the loaded model is one Onde has verified for structured tool calls. `Supported` means catalogued and tested. `Unsupported` means catalogued and not tested, which is a statement about Onde's coverage rather than the model's capability: some of those models ship tool-call templates and may well work. `Unknown` means the repository is not in the catalogue at all. An engine with nothing loaded answers `Unsupported`.

6 +* `models::tool_calling_support()` and `models::TOOL_CALLING_MODELS` give the same answer without an engine. Matching is exact, so a custom repository whose name resembles a catalogued one stays `Unknown` rather than inheriting a verification it never had.

7 +* `ChatEngine::record_tool_results()` appends tool results to history without starting another inference round. Agent hosts need it when a turn is cancelled after the assistant has already asked for tools. It records only results answering a call the assistant actually made and has not already been answered, and returns how many it kept, because a tool result with no matching request builds a message sequence the model cannot read.

8 +* `ToolCallingSupport` is exported from `onde::inference`.

9 +

10 +None of this reaches the UniFFI surface yet, so the Swift, Kotlin, Flutter/Dart, and React Native packages gain no new API in this release.

11 +

12 +### Release automation

13 +

14 +* The React Native package publishes through npm trusted publishing (OIDC) instead of a long-lived `NPM_TOKEN`. The publish job requests `id-token: write` and upgrades npm before publishing, since Node 22 still ships npm 10 and trusted publishing needs 11.5.1 or newer. The trusted publisher configured on npmjs.com has to keep matching what the job declares, or npm answers the publish with a 404.

15 +* The npm workflow runs a preflight gate before the publish step.

16 +

17 +### Packaging

18 +

19 +* Release metadata is aligned for Rust, Swift, Kotlin, Flutter/Dart, and React Native SDKs under version `1.2.5`.

20 +

21 ## 1.1.1

23 ### Apple SDK compatibility