From c3c49e514651fd604db28b5b47992cb3a3c73db1 Mon Sep 17 00:00:00 2001 From: Isaac Insoll Date: Wed, 5 Aug 2026 12:45:59 +1000 Subject: [PATCH] =?UTF-8?q?=F0=9F=93=9D=20record=20release=20environment?= =?UTF-8?q?=20setup?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Document the verified v*-only npm-publish environment and narrow the remaining pre-RC setup to the temporary bootstrap credential. --- docs/RELEASING.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/RELEASING.md b/docs/RELEASING.md index c469869..7a0feab 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -1,9 +1,10 @@ # Release Process > **Pre-release status:** `release-it` and `.github/workflows/release.yml` are -> configured, but the `npm-publish` environment, bootstrap token, and npm trusted -> publisher still require setup. Do not create a release tag until those controls -> are ready. Progress is tracked in `MODERNIZATION_PLAN.md`. +> configured, and the `npm-publish` environment accepts only `v*` tags without a +> redundant reviewer gate. The bootstrap token and npm trusted publisher still +> require setup. Do not create a release tag until the applicable credential is +> ready. Progress is tracked in `MODERNIZATION_PLAN.md`. `@picr/react-grid-gallery` is published only by the maintainer through GitHub Actions. Do not run `npm publish` from a development machine or add a long-lived @@ -50,12 +51,11 @@ The package must exist on npm before trusted publishing can be configured. The GitHub Actions workflow, publishes with provenance and the `next` tag, verifies that npm has not created `latest`, then revokes the token immediately. -After `release.yml` is merged, create the `npm-publish` GitHub environment with -deployment restricted to tags matching `v*` and no required reviewers. Add a -short-expiry granular `NPM_BOOTSTRAP_TOKEN` environment secret with only the -access needed to create the public package under `@picr`; because the first -publish is non-interactive, this one token must be allowed to bypass publish -2FA. Do not create the RC tag until both are ready. +The `npm-publish` GitHub environment is restricted to tags matching `v*` and has +no required reviewers. Add a short-expiry granular `NPM_BOOTSTRAP_TOKEN` +environment secret with only the access needed to create the public package +under `@picr`; because the first publish is non-interactive, this one token must +be allowed to bypass publish 2FA. Do not create the RC tag until it is ready. After bootstrap, configure stage-only npm trusted publishing for the permanent workflow and a release-tag-restricted `npm-publish` GitHub environment. Verify