ci(release): consume shared pnpm-release-management toolchain

.changeset/README.md

@@ -18,7 +18,13 @@ pnpm change --bump <none|patch|minor|major> --summary "<changelog entry>" [<pkg>
 - This README is NOT a changeset: the gate requires a file whose frontmatter
   parses as `"<pkg>": <none|patch|minor|major>`.
 
-Publishing uses npm OIDC trusted publishing from `.github/workflows/release.yml`.
-Register `@systemfsoftware/omp-claude-compat` as a trusted publisher on npmjs.com
-pointing at this repository and that workflow filename before the first new
-version can ship. OIDC cannot debut a package npm has never seen.
+Releases are driven by the shared release toolchain
+(`systemfsoftware/pnpm-release-management`), consumed as a reusable workflow from
+`.github/workflows/release.yml` and configured by this repo's `release.jsonc`.
+Distribution is this repository's Nix flake outputs consumed from a git ref
+(pinned by `flake.lock` rev + narHash), not an npm registry: the release path
+writes a `@systemfsoftware/omp-claude-compat@vX.Y.Z` git tag and a GitHub Release
+for each unreleased version — there is no npm token, no OIDC trusted publishing,
+and no registry to configure. The git tag is the durable record that a version
+shipped, and tagging is idempotent, so a half-finished release resumes safely on
+the next push to `main`.

.github/workflows/changeset-check.yml

@@ -1,3 +1,8 @@
+# Thin caller of the shared changeset-check reusable workflow
+# (systemfsoftware/pnpm-release-management). It requires a change intent for
+# every publishable-package change in a pull request.
+#
+# tools-ref pins the toolchain revision the check runs from.
 name: Changeset Check
 
 on:
@@ -6,16 +11,10 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
-  require-changeset:
-    if: github.head_ref != 'changeset-release/main'
-    name: a publishable-package change needs a changeset
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - uses: denoland/setup-deno@v2
-      - name: Require a changeset for publishable-package changes
-        run: ./scripts/check-changeset.ts ${{ github.event.pull_request.base.sha }}
+  changeset-check:
+    uses: systemfsoftware/pnpm-release-management/.github/workflows/changeset-check.yml@prm/toolchain
+    with:
+      tools-ref: prm/toolchain

.github/workflows/release.yml

@@ -1,116 +1,23 @@
+# Thin caller of the shared release toolchain
+# (systemfsoftware/pnpm-release-management). The reusable workflow is the single
+# definition of the release flow; this caller only supplies the trigger and the
+# permissions. The toolchain reads this repo's release.jsonc and derives the
+# phase (version / release / none) from repository state.
+#
+# tools-ref pins the toolchain revision the release runs from.
 name: Release
 
 on:
   push:
     branches: [main]
-
-concurrency:
-  group: release-${{ github.ref }}
-  cancel-in-progress: false
+  workflow_dispatch:
 
 permissions:
   contents: write
   pull-requests: write
 
 jobs:
-  plan:
-    name: plan · derive phase
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    outputs:
-      phase: ${{ steps.plan.outputs.phase }}
-    env:
-      HUSKY: "0"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          fetch-tags: true
-      - uses: denoland/setup-deno@v2
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - name: Preflight intent consumption
-        run: pnpm version -r --dry-run
-      - id: plan
-        name: Decide release phase from repository state
-        run: ./scripts/plan-release.ts --output "$GITHUB_OUTPUT"
-
-  version:
-    if: needs.plan.outputs.phase == 'version'
-    needs: [plan]
-    name: version · open release PR
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    env:
-      HUSKY: "0"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - uses: denoland/setup-deno@v2
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - name: Consume pending change intents
-        run: pnpm version -r
-      - name: Capture release set
-        run: ./scripts/tag-released-packages.ts --dry-run --json --output /tmp/captured.json && cat /tmp/captured.json
-      - name: Assert release notes
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: ./scripts/create-github-releases.ts --assert --captured /tmp/captured.json
-      - name: Open or update the Release PR
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BRANCH: changeset-release/main
-          BASE: ${{ github.event.repository.default_branch }}
-        run: ./scripts/open-release-pr.sh
-
-  publish:
-    if: needs.plan.outputs.phase == 'publish'
-    permissions:
-      contents: write
-      id-token: write
-    name: publish · oidc · tag
-    needs: [plan]
-    runs-on: ubuntu-latest
-    env:
-      HUSKY: "0"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          fetch-tags: true
-      - uses: denoland/setup-deno@v2
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - name: Capture release set
-        run: ./scripts/tag-released-packages.ts --dry-run --json --output /tmp/captured.json
-      - name: Assert release notes
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: ./scripts/create-github-releases.ts --assert --captured /tmp/captured.json
-      - name: Build
-        run: pnpm build
-      - name: Publish unpublished versions via OIDC
-        run: ./scripts/tag-released-packages.ts --unpublished --captured /tmp/captured.json --publish
-      - name: Tag released versions
-        run: ./scripts/tag-released-packages.ts --captured /tmp/captured.json
-      - name: GitHub Releases from authored changelogs
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: ./scripts/create-github-releases.ts --captured /tmp/captured.json
+  release:
+    uses: systemfsoftware/pnpm-release-management/.github/workflows/release.yml@prm/toolchain
+    with:
+      tools-ref: prm/toolchain

README.md

@@ -4,23 +4,23 @@
 
 `@systemfsoftware/omp-claude-compat` brings your Claude Code configuration into [Oh My Pi](https://github.com/can1357/oh-my-pi) (OMP). Your hooks keep firing. Your `CLAUDE.md` rules keep applying. You change nothing — install one plugin and your existing setup just works.
 
-[![npm version](https://img.shields.io/npm/v/@systemfsoftware/omp-claude-compat?style=flat)](https://www.npmjs.com/package/@systemfsoftware/omp-claude-compat)
-[![license](https://img.shields.io/npm/l/@systemfsoftware/omp-claude-compat?style=flat)](./LICENSE)
+[![license](https://img.shields.io/badge/license-Apache--2.0-blue?style=flat)](./LICENSE)
 
 ## What is this?
 
 This is a plugin for Oh My Pi that understands Claude Code configuration. It runs the hooks you defined in `.claude/settings.json` at the right moments, and it feeds the files your `CLAUDE.md` points at into the agent's instructions. One plugin, zero rewriting of your existing files.
 
 ## Install
 
-**How do I use my Claude Code setup in Oh My Pi?** Install the package and list it as a plugin:
+**How do I use my Claude Code setup in Oh My Pi?** Add it as a Nix flake input
+and list it as a plugin. This package is **not** published to any npm registry —
+distribution is this repository's Nix flake outputs, consumed from a git ref and
+pinned by `flake.lock` rev + narHash:
 
-```bash
-pnpm add @systemfsoftware/omp-claude-compat
-```
-
-```bash
-npm install @systemfsoftware/omp-claude-compat
+```nix
+{
+  inputs.omp-claude-compat.url = "github:systemfsoftware/omp-claude-compat";
+}
 ```
 
 ```json

docs/solutions/integration-issues/standalone-release-drops-github-releases.md

@@ -49,7 +49,7 @@ Root-cause chain: the port preserved the plan/version/publish skeleton but dropp
 
 Architectural invariants:
 
-- **Terminal-action completeness.** A release pipeline's terminal phase must produce every consumer-visible artifact (registry version, tag, Release object with notes and latest promotion). If the last step only moves a ref, the pipeline ships half a release by construction.
+- **Terminal-action completeness.** A release pipeline's terminal phase must produce every consumer-visible artifact. For this repo that is the `<pkg>@vX.Y.Z` git tag and the GitHub Release object with notes and latest promotion — distribution is this repository's Nix flake outputs consumed from a git ref, so the tag is the durable record that a version shipped and there is no registry version to produce. If the last step only moves a ref without cutting the Release, the pipeline ships half a release by construction.
 - **Generated-output capture.** Let $G$ be the generator's output set and $S$ the staged set. Update-only staging stages $\{f : \text{tracked}(f)\}$; generated files start untracked, so $S \cap G = \varnothing$ always. Completeness requires the staging predicate to cover $G$, not just tracked modifications.
 - **Assert at consumption.** Each phase asserts the artifacts it consumes before acting on them. A producer/consumer handoff (captured set, changelog files) with no consumer-side check converts every upstream drop into a silent downstream degradation.
 

release.jsonc

@@ -0,0 +1,19 @@
+{
+  // Config for the shared release toolchain
+  // (systemfsoftware/pnpm-release-management), consumed as a reusable workflow.
+  // The toolchain derives the release phase from repository state and reads this
+  // file; there is no local release tooling in this repo.
+  //
+  // Distribution is this repository's Nix flake outputs consumed from a git ref
+  // (pinned by flake.lock rev + narHash), not an npm registry. The release path
+  // writes a <pkg>@vX.Y.Z git tag and a GitHub Release per unreleased version —
+  // no npm token, no OIDC, no registry.
+  "base": "main",
+  "branch": "changeset-release/main",
+  "changesetDir": ".changeset",
+  "changelogDir": ".changeset/changelogs",
+  "versioning": {
+    "strategy": "pnpm",
+  },
+  "gate": { "strategy": "paths" },
+}