Epic: org-wide publish (GH Packages + @kolektiv npm + JSR) & Gradle conventions

[LizAinslie]

Goals (Mey 2026-09-14)

1. Every artifact-publishing repo also publishes to GitHub Packages (keep existing Yuri Capital / Nexus where present).
2. npm packages under @kolektiv/... (and dual-publish to GH npm registry where useful).
3. JSR scope for Kolektiv (@kolektiv preferred; claim when awake) with OIDC from Actions.
4. Org-wide Gradle conventions for common publishing/config so repos don’t copy-paste publishing {} forever.

Maven

• Dual repos in publishing.repositories: existing Yuri Capital and https://maven.pkg.github.com/KolektivComputer/<repo>
• Auth: GITHUB_TOKEN with packages: write on the publish job
• GroupIds: computer.kolektiv.* (separate boarding already in flight)

npm

• Scope @kolektiv/* everywhere (Keel/brand/themes already)
• Dual: keep repo.yuri.capital where used; add https://npm.pkg.github.com with @kolektiv:registry=… in CI
• Trusted Publishing / OIDC where possible

JSR

• Claim @kolektiv (or @kolektiv-computer if taken) on jsr.io
• jsr.json + npx jsr publish / OIDC from Actions — not a substitute for npm publish
• Consumers may use @jsr/… — document both

Gradle conventions

• New published plugin or included build: computer.kolektiv.publishing (and maybe computer.kolektiv.base)
• Lives in KolektivComputer/gradle-conventions (or under this .github repo until spun out)
• Repos apply the plugin; local overrides only for pom name/url/license

Reusable workflows (this repo)

• publish-maven.yml / publish-npm.yml / publish-jsr.yml fragments under .github/workflows/ for workflow_call

Repo sweep (PRs)

• Maven-ish: keel, kalendee, kraft, konfy, kord, lokus (backend), wake (if libs), others with maven-publish
• npm: keel, brand, themes, kalendee workers/pack, email-worker, TimezoneDB platforms, lokus web
• Apps-only (Kompass): skip Maven unless they publish an AAR later

Mey later (secrets / accounts)

• Org Packages permissions / GITHUB_TOKEN packages write
• Claim JSR @kolektiv
• npm Trusted Publishing / GH Packages npm auth
• Wire org secrets if dual Yuri+GH still needed

[LizAinslie]

Cloud agents launching for dual-publish PRs + gradle-conventions starter. Mey configures JSR/@kolektiv claim + Packages secrets after sleep.

[LizAinslie]

PR sweep (opened 2026-09-14)

Org / conventions

• gradle-conventions#1 — computer.kolektiv.publishing bootstrap
• .github docs PR — publishing.md + workflow-templates (search chore/org-publish-docs)

Maven dual (GH Packages)

• keel#68
• kalendee#33
• kraft#8
• konfy#8
• kord#1

npm @kolektiv + JSR stubs

• brand / themes / email-worker / lokus — see open PRs titled dual-publish / scope

Blocked without Mey

• Editing .github/workflows/* needs a token with workflows scope — each PR has docs/CI_DUAL_PUBLISH.md (or org workflow-templates/) to paste
• Claim JSR @kolektiv, wire Packages, dual-publish secrets

Discord: Humanizer’s Kolektiv announcement draft is ready to paste as-is.

[LizAinslie]

Locked (Mey 2026-09-14)

JSR scope is @kolektiv (owned). Same scope as npm.

Next when wiring Actions: link each JSR package to its GitHub repo for OIDC (id-token: write) — no long-lived JSR token.

[kolektiv]

Hello! Sorry, not meaning to intrude, but GitHub summons me if you use @kolektiv as, well... It Me. Just a note! I'm not using kolektiv as an org on npmjs either, but let me know if there's somewhere I am just in case I don't need it!