@brignano/design 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +29 -5
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -22,8 +22,8 @@ Distinctiveness lives in the brand layer; conventionality lives in the control l
|
|
|
22
22
|
|
|
23
23
|
## Consuming it
|
|
24
24
|
|
|
25
|
-
```
|
|
26
|
-
|
|
25
|
+
```sh
|
|
26
|
+
npm install @brignano/design
|
|
27
27
|
```
|
|
28
28
|
|
|
29
29
|
```css
|
|
@@ -43,6 +43,30 @@ outside `tokens.css`** — a literal survives a theme change silently, which is
|
|
|
43
43
|
|
|
44
44
|
## Status
|
|
45
45
|
|
|
46
|
-
|
|
47
|
-
`
|
|
48
|
-
|
|
46
|
+
`0.x`, and deliberately so. `brignano.io` consumes it; `life`, `homelab` and
|
|
47
|
+
`driftwood` don't yet. Token *names* may still move while those land, and a `0.x`
|
|
48
|
+
range says that out loud — a caret on `0.x` pins the minor, so `^0.1.1` won't
|
|
49
|
+
silently take a breaking rename the way `^1.1.0` would. `1.0.0` gets cut when the
|
|
50
|
+
names stop changing, not on a date.
|
|
51
|
+
|
|
52
|
+
Versions track the *tokens*, not the plumbing. A release that changes only
|
|
53
|
+
packaging or docs is a patch; the minor is reserved for the first release where
|
|
54
|
+
something actually looks different.
|
|
55
|
+
|
|
56
|
+
## Releasing
|
|
57
|
+
|
|
58
|
+
The tag is the trigger. `.github/workflows/release.yml` publishes to npm on any
|
|
59
|
+
`v*` tag, after checking the tag agrees with `package.json` — npm versions are
|
|
60
|
+
immutable, so a mismatch is caught before it's permanent.
|
|
61
|
+
|
|
62
|
+
```sh
|
|
63
|
+
npm version minor # bumps package.json, commits, tags
|
|
64
|
+
git push --follow-tags
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
Publishing is done by CI, never from a laptop. There is no npm token anywhere in
|
|
68
|
+
this repo and there should never be one — the runner exchanges its OIDC identity
|
|
69
|
+
for a short-lived credential via npm [trusted publishing][tp], which is also what
|
|
70
|
+
produces the provenance attestation. A laptop has no such identity.
|
|
71
|
+
|
|
72
|
+
[tp]: https://docs.npmjs.com/trusted-publishers/
|