Build and publish

Build never leaves the repository. Each repo calls a shared publish workflow — one per language/framework and kind (publish-node-app, publish-solution, publish-config, …) owned by WilldanGroup/switchboard-kit — that installs, tests, packages, and cuts the semantic-release version. Artifacts land in the org devops buckets through the OIDC deploy roles; no credentials live in GitHub.

Every publish:

1. lands a build row — commit, test result, artifact, channel;
2. advances a channel head — alpha/<branch> for branch builds, beta for every merge to the default branch;
3. deploys nowhere by itself — environments follow channels, and stable advances only when a release is approved.

A version on a channel traces back to the build that made it, and every environment the version reached is on the build row.

GET /v1/builds?repo=… and GET /v1/channels?repo=… in the API reference.