From cf4c851058335689d106be26f4089e77dbcf95f6 Mon Sep 17 00:00:00 2001 From: Isaac Insoll Date: Mon, 10 Aug 2026 16:00:44 +1000 Subject: [PATCH] =?UTF-8?q?=F0=9F=93=9D=20record=20Storybook=20completion?= =?UTF-8?q?=20and=201.1=20release=20scope?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- GITHUB_ISSUE_STORYBOOK.md | 13 +++++++++---- MODERNIZATION_PLAN.md | 26 ++++++++++++++++++++++++++ docs/RELEASING.md | 18 ++++++++++++++++++ 3 files changed, 53 insertions(+), 4 deletions(-) diff --git a/GITHUB_ISSUE_STORYBOOK.md b/GITHUB_ISSUE_STORYBOOK.md index 39b0f0f..fa3a2b8 100644 --- a/GITHUB_ISSUE_STORYBOOK.md +++ b/GITHUB_ISSUE_STORYBOOK.md @@ -272,14 +272,19 @@ build` job so a broken documentation site cannot merge through auto-merge. ## Acceptance Criteria - [x] `npm run storybook` starts the site locally -- [ ] `npm run build-storybook` succeeds in hosted CI (pending local review and - pull request) +- [x] `npm run build-storybook` succeeds in hosted CI through + [PR #27](https://github.com/IsaacInsoll/react-grid-gallery/pull/27) and its + successful required + [CI run](https://github.com/IsaacInsoll/react-grid-gallery/actions/runs/31359292755) - [x] Storybook-backed Playwright scenarios use the same static build locally and in CI - [x] Existing dist-backed Playwright coverage remains green until an explicitly reviewed parity migration preserves equivalent built-artifact coverage -- [ ] The deployed Pages site works from the repository's configured base path - (Pages is configured for Actions; deployment awaits merge) +- [x] The deployed Pages site works from the repository's configured base path; + the first protected + [Pages deployment](https://github.com/IsaacInsoll/react-grid-gallery/actions/runs/31359400123) + succeeded and serves the + [maintained documentation](https://isaacinsoll.github.io/react-grid-gallery/) - [x] Component controls and curated docs accurately describe the public API - [x] Storybook does not duplicate authoritative Markdown documentation or load remote runtime assets diff --git a/MODERNIZATION_PLAN.md b/MODERNIZATION_PLAN.md index e59ec63..5ff8252 100644 --- a/MODERNIZATION_PLAN.md +++ b/MODERNIZATION_PLAN.md @@ -1802,6 +1802,15 @@ applications.` the manager never exposes an unpainted light strip below short stories in dark mode; keep inline documentation canvases content-sized to avoid restoring their resize feedback loop. + - Completed 2026-08-10 through + [PR #27](https://github.com/IsaacInsoll/react-grid-gallery/pull/27): all + required hosted checks passed in + [CI run #31359292755](https://github.com/IsaacInsoll/react-grid-gallery/actions/runs/31359292755), + including the clean-clone package-root type-resolution correction found by + the first hosted attempt. The protected + [Pages run #31359400123](https://github.com/IsaacInsoll/react-grid-gallery/actions/runs/31359400123) + then deployed the maintained documentation successfully at the configured + repository base path. - Consumer fixtures: keep at least one Vite + React + TypeScript smoke test for packed package installs. @@ -2051,3 +2060,20 @@ informed this package API and is credited in the changelog and acknowledgements. Only the reusable library capability was adopted; PICR backend, GraphQL, branding, and administration work remain outside this package. + +## Post-1.0: Release 1.1.0 + +The maintainer decided on 2026-08-10 to release `1.1.0` from the current +post-Storybook `main` state after manually confirming npm's package-level +**Require two-factor authentication and disallow tokens** publishing-access +setting. Do not add upstream-triage fixes or unrelated features to this release +without a new explicit scope decision. + +Immediately before running the documented release process, complete the +existing `v1.1.0` changelog section with the maintained Storybook documentation +launch and confirm its release date. Keep that changelog edit as the only +unstaged tracked change required by `docs/RELEASING.md`; do not commit it through +an ordinary documentation pull request first. Run the full stable-release flow, +approve the staged package with npm 2FA, move `next` to `1.1.0` after npm +publication, and require finalization to verify both `latest` and `next` before +publishing the GitHub Release. diff --git a/docs/RELEASING.md b/docs/RELEASING.md index 2620660..493f6f8 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -83,6 +83,24 @@ Set and keep package publishing access configured to require 2FA and disallow tokens. npm trusted publishing continues to work because it uses short-lived OIDC credentials rather than traditional automation tokens. +Verify this package-specific control in npm's web interface before a stable +release, following npm's +[trusted-publishing guidance](https://docs.npmjs.com/trusted-publishers/#recommended-restrict-token-access-when-using-trusted-publishers); +the CLI cannot confirm that traditional tokens are disallowed: + +1. Sign in to npmjs.com and open `@picr/react-grid-gallery`. +2. Open **Settings**, then find **Publishing access**. +3. Select **Require two-factor authentication and disallow tokens + (recommended)**. +4. Click **Update Package Settings** if the selection changed, completing the + requested 2FA challenge. +5. Confirm the same option remains selected after the settings page reloads. + +This restriction applies to traditional granular-token authentication, not the +short-lived OIDC credentials issued to the configured trusted publisher. Keep +the trusted publisher limited to `npm stage publish`; the staged package still +requires a maintainer's explicit 2FA approval before publication. + The bootstrap token was read only by the `1.0.0-rc.0` publish step. Both the GitHub environment secret and the corresponding granular npm token have been removed, and the one-off token branch has been removed from the permanent