@conduction/docusaurus-preset 0.1.0 → 1.0.0

package/README.md

@@ -139,32 +139,36 @@ This is how product sites such as `mydash.conduction.nl/docs/...` adopt the bran
 
 ## Releasing
 
-Releases are tag-triggered. Pushing a tag `vX.Y.Z` runs [.github/workflows/publish-packages.yml](../.github/workflows/publish-packages.yml), which publishes `@conduction/docusaurus-preset` to npm under the `@conduction` scope. The diagram primitives ship inside the same tarball under `src/diagrams/`, so there is exactly one npm release per tag.
+Releases auto-publish on push to `main`. The [.github/workflows/publish-packages.yml](../.github/workflows/publish-packages.yml) workflow compares the version in this `package.json` against what's on `registry.npmjs.org`. Bump the version, push, the workflow publishes. No bump means no publish — the workflow exits cleanly. Tag pushes (`v*`) and manual `workflow_dispatch` runs (with an optional dry-run flag) are accepted for explicit republishes and emergency holds.
 
-**One-time setup** (per repo, since Conduction keeps secrets repo-local):
+The diagram primitives ship inside the same tarball under `src/diagrams/`, so there is exactly one npm release per push.
 
-1. Sign in to npm with an account that's a member of the `@conduction` org and has publish rights on the scope. (`npm login` from the CLI, or via [npmjs.com](https://www.npmjs.com/login).)
-2. Create an automation token under your *user* settings (npm tokens are user-level, not org-level): npmjs.com → avatar dropdown → "Access Tokens" → "Generate New Token" → **Automation**. Copy the value.
-3. Add it as a repo secret: <https://github.com/ConductionNL/design-system/settings/secrets/actions> → "New repository secret" → name `NPM_TOKEN`, paste the token.
-4. (Optional) Verify the workflow with a dry run: Actions → "Publish packages" → Run workflow → leave "dry_run" checked. Watch for `+ @conduction/docusaurus-preset@…` in the logs without an actual upload.
+**One-time setup**: configure the npm Trusted Publisher (OIDC) link.
 
-The token publishes **on behalf of the user account**, not the org, so anyone with the right org-level permission can generate the token. Rotate by replacing the secret; no need to redeploy or amend the workflow.
+1. Open the package settings on npm: <https://www.npmjs.com/package/@conduction/docusaurus-preset/access>. Scroll to "Trusted Publisher" and click "Set up connection".
+2. Fill in:
+   - Publisher: GitHub Actions
+   - Organization or user: `ConductionNL`
+   - Repository: `design-system`
+   - Workflow filename: `publish-packages.yml`
+   - Environment name: leave empty (or set to a GitHub Environment if you later want a manual approval gate)
+3. Click "Set up connection".
+
+That's it. There is no token to generate, no secret to install, no expiry to track. The workflow's `permissions: id-token: write` lets the runner request a short-lived OIDC token; npm validates the `{repo, workflow}` claim against the trust config and issues a one-shot publish credential. Each release is also signed with a [provenance attestation](https://docs.npmjs.com/generating-provenance-statements) so consumers can verify the build came from this exact workflow run.
 
 **Per release:**
 
 ```bash
 # Bump the preset version. The diagrams source ships inside the preset,
-# so there is one version to bump and one tag to push.
+# so there is one version to bump.
 $EDITOR docusaurus-preset/package.json   # "version": "0.2.0"
 
 git add docusaurus-preset/package.json
 git commit -m "Bump @conduction/docusaurus-preset to 0.2.0"
-git tag v0.2.0
-git push origin main
-git push origin v0.2.0   # this triggers the publish workflow
+git push origin main   # the workflow detects the bump and publishes
 ```
 
-The workflow runs `npm publish --workspace @conduction/docusaurus-preset --access public`. Watch the run on the Actions tab. If it fails, fix the issue, bump the patch (`0.2.1`), re-tag — npm rejects re-publishing the same version.
+The workflow runs `npm publish --workspace @conduction/docusaurus-preset --access public`. Watch the run on the Actions tab. If it fails, fix the issue, bump the patch (`0.2.1`), push again — npm rejects re-publishing the same version, so a single failed run can't block a corrected re-bump.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@conduction/docusaurus-preset",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "description": "Conduction brand preset for Docusaurus 3. Tokens, theme, navbar, footer, i18n config for nl/en/de/fr, and the React component library that powers conduction.nl and the Conduction product sites.",
   "main": "src/index.js",
   "exports": {