DX | 03-08-2026 | Release | Back-merge

.cursor/rules/README.md

@@ -1,20 +1,5 @@
-# Cursor rules for `@contentstack/datasync-manager`
+# Cursor (optional)
 
-Rules live in this folder as `.mdc` (and `dev-workflow.md`) with YAML frontmatter. Use them so changes stay aligned with DataSync, the Sync API, and this repo’s TypeScript/Jest setup.
+*Cursor* users: start at *[AGENTS.md](../../AGENTS.md)*. All conventions live in **skills/*/SKILL.md**.
 
-## How to reference rules
-
-In Cursor chat, you can **@** mention a rule file (e.g. `@dev-workflow`, `@typescript`, `@contentstack-datasync-sync-api`, `@testing`, `@code-review`) to pull it into context when working on matching files or tasks.
-
-| File | `alwaysApply` | `globs` | When it applies |
-|------|---------------|---------|-----------------|
-| [dev-workflow.md](./dev-workflow.md) | no | *(none)* | Branching, CI/versioning, how to run lint/tests, PR expectations. |
-| [typescript.mdc](./typescript.mdc) | no | `src/**/*.ts` | TypeScript layout, logging (`debug`), style notes (TSLint/ESLint, `tsconfig`). |
-| [contentstack-datasync-sync-api.mdc](./contentstack-datasync-sync-api.mdc) | no | `src/api.ts`, `src/config.ts`, `src/core/**/*.ts` | Sync API usage: delivery token, host/branch, retries, `https` client behavior — **not** CMA. |
-| [testing.mdc](./testing.mdc) | no | `test/**/*.ts`, `jest.config.js` | Jest, nock, `PLUGIN_PATH`, dummy config paths. |
-| [code-review.mdc](./code-review.mdc) | **yes** | *(global)* | PR checklist: API docs, compatibility, errors, security, tests, DataSync terminology. |
-
-## Related docs
-
-- [AGENTS.md](../../AGENTS.md) — single entry point for the repo.  
-- [skills/README.md](../../skills/README.md) — expanded checklists and how-tos.  
+This folder only points contributors to *AGENTS.md* so editor-specific config does not duplicate the canonical docs.

.github/workflows/release.yml

@@ -0,0 +1,57 @@
+name: Release
+
+on:
+  release:
+    types: [created]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      # Checkout the repository
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # Setup Node.js environment
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22.x"
+
+      # Install dependencies
+      - name: Install dependencies
+        run: npm install
+
+      # Build (dist/ is published per package.json "files")
+      - name: Build
+        run: npm run build-ts
+
+      # Fetch package details (name and version)
+      - name: Get package details
+        id: package
+        uses: codex-team/action-nodejs-package-info@v1.1
+
+      # Pack the package into a .tgz archive (@contentstack/datasync-manager → contentstack-datasync-manager-<version>.tgz)
+      - name: Pack the npm package
+        run: npm pack
+
+      # Publish the package to npm
+      - name: Publish to npm
+        id: publish_npm
+        uses: JS-DevTools/npm-publish@v3
+        with:
+          token: ${{ secrets.NPM_TOKEN }}
+          # access: public # Uncomment if you need to publish a scoped package as public for the first time
+
+      # Upload the packaged .tgz to the release that triggered this workflow
+      - name: Upload Release Asset
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ github.event.release.upload_url }}
+          asset_path: "./contentstack-datasync-manager-${{ steps.package.outputs.version }}.tgz"
+          asset_name: "contentstack-datasync-manager-${{ steps.package.outputs.version }}.tgz"
+          asset_content_type: application/tgz

.github/workflows/sca-scan.yml

@@ -5,6 +5,9 @@ on:
 jobs:
   security-sca:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@master
       - name: Run Snyk to check for vulnerabilities

.talismanrc

@@ -4,9 +4,10 @@ fileignoreconfig:
     - filecontent
 - filename: .github/workflows/check-version-bump.yml
   ignore_detectors:
-    - filecontent
-- filename: package-lock.json
-  checksum: 1525b038bc7500db7a4b489db28529cd0b2ada15afc7110d818fe13657303612
-- filename: .husky/pre-commit
-  checksum: 1b9367d219802de2e3a8af9c5c698e0c255c00af89339d73bdbb8acf5275079f
-version: ""
+- filename: skills/dev-workflow/SKILL.md
+  checksum: c9fa42c57463f3d00aa34ab6c8b4e58b984cd6a3a5878d25596e6e66abb4a129
+- filename: skills/contentstack-datasync/SKILL.md
+  checksum: 62cf62a46c4dcdd9603b1e6ef910e0d77dfa39d2350db992a6a45d3a2791eaee
+- filename: skills/testing/SKILL.md
+  checksum: ab1f82b284189e2779570d4fd5edcde93494c1ee01110da9f0be6f1f5cf5177b
+version: "1.0"