@dori-ai/dori-pdp-widget 0.6.56 → 0.6.58

package/README.md

@@ -69,6 +69,31 @@ npm run build
 
 This will create a `dist` folder with the production-ready widget files.
 
+### Publishing (`@dori-ai/dori-pdp-widget`)
+
+```bash
+npm run publish:dev:scoped    # any branch -> <version>-dev.<timestamp> under @dev
+npm run publish:prod:scoped   # main only  -> bumps the patch, publishes @latest
+npm run publish:prod:dry      # shows the version a prod publish would take
+```
+
+The same script runs in CI via `.github/workflows/publish.yml`, authenticated
+with npm trusted publishing (per-run OIDC token, no npm token anywhere):
+
+```bash
+gh workflow run publish.yml -f channel=dev  --ref dev  -R DoriService/dori-pdp-widget
+gh workflow run publish.yml -f channel=prod --ref main -R DoriService/dori-pdp-widget
+```
+
+The prod run aligns `package.json` with the highest version on the registry,
+bumps the patch, publishes `@latest` and commits the bump back to `main`. Pull
+before a local prod publish afterwards or the next bump collides. The
+trusted-publisher entry on npmjs.com is keyed on the workflow filename;
+renaming `publish.yml` breaks CI publishing until it is updated.
+
+CI releases carry no npm provenance: npm only accepts a provenance bundle from
+a public source repository, and this repo is private.
+
 ### Development vs Production
 
 - **Development**: `npm run dev` - Uses direct DOM rendering for easier debugging