@hamedb89/localghost 0.1.0 → 0.1.3

package/README.md

@@ -8,6 +8,8 @@ Buh. Friendly local hostnames for app repos.
 
 [![CI](https://github.com/hamedb89/localghost/actions/workflows/ci.yml/badge.svg)](https://github.com/hamedb89/localghost/actions/workflows/ci.yml)
 [![GitHub Pages](https://github.com/hamedb89/localghost/actions/workflows/pages.yml/badge.svg)](https://github.com/hamedb89/localghost/actions/workflows/pages.yml)
+[![Publish npm](https://github.com/hamedb89/localghost/actions/workflows/publish-npm.yml/badge.svg)](https://github.com/hamedb89/localghost/actions/workflows/publish-npm.yml)
+[![npm version](https://img.shields.io/badge/npm-v0.1.3-CB3837?logo=npm)](https://www.npmjs.com/package/@hamedb89/localghost)
 
 Localghost is a tiny Node.js CLI for local HTTPS domains in app repos. It gives each project one small contract for `.localhost` hostnames, Caddy reverse proxies, Vite `allowedHosts`, and the system hosts file, so developers can open `https://app.localhost/` instead of remembering which localhost port belongs to which process.
 

package/docs/github.md

@@ -120,10 +120,48 @@ npm run release:check
 
 That command typechecks, builds the package, builds the static site, and runs `npm pack --dry-run`.
 
-`.github/workflows/publish-npm.yml` publishes to npm from a published GitHub release or manual workflow dispatch. The workflow reruns `npm run release:check` before publishing and uses:
+`.github/workflows/publish-npm.yml` publishes to npm when a `v*` tag is pushed, or from manual workflow dispatch. The workflow checks that tag names match `package.json` versions, reruns `npm run release:check`, and then uses:
 
 ```sh
-npm publish --access public --provenance
+npm run publish:public
 ```
 
-Configure npm trusted publishing for `hamedb89/localghost` before relying on the release workflow. Local manual publishes are guarded by the `prepublishOnly` package hook, which runs the same release check.
+That package script runs `npm publish --access public --provenance`.
+
+Configure npm trusted publishing for `hamedb89/localghost` before relying on the release workflow. On npmjs.com, open the package settings and add a trusted publisher with:
+
+```txt
+Provider: GitHub Actions
+Organization or user: hamedb89
+Repository: localghost
+Workflow filename: publish-npm.yml
+Environment name: npm
+Allowed actions: npm publish
+```
+
+The workflow must keep `id-token: write`, run on a GitHub-hosted runner, and use a recent npm CLI. Trusted publishing does not need an `NPM_TOKEN` secret. npm automatically generates provenance for public packages published from public GitHub repositories through trusted publishing.
+
+If the workflow reaches `npm publish` and npm returns `404 Not Found` or a permission-flavored 404 for `@hamedb89/localghost`, recheck the trusted publisher fields above. The package, repository, workflow filename, environment name, and allowed action must match exactly.
+
+Local manual publishes are guarded by the `prepublishOnly` package hook, which runs the same release check.
+
+## Patch Release Workflow
+
+Use patch releases for docs, packaging metadata, small fixes, and backwards-compatible CLI/API changes. Do not overwrite a published npm version; npm package versions are immutable, and git tags should continue to identify the source that produced that published package.
+
+For a normal patch release:
+
+```sh
+git status --short
+npm run release:check
+npm version patch
+git push origin main --tags
+```
+
+Pushing the `v*` tag starts the npm publish workflow automatically. The workflow reruns `npm run release:check` before publishing. Create the GitHub release afterwards if you want release notes on GitHub.
+
+If publishing from a local terminal instead of GitHub Actions, omit provenance and provide the npm two-factor code:
+
+```sh
+npm publish --access public --otp=123456
+```

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@hamedb89/localghost",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "Friendly local HTTPS hostnames for app repos with .localghost, Caddy, /etc/hosts, and Vite.",
   "type": "module",
   "bin": {
-    "localghost": "./dist/cli.js"
+    "localghost": "dist/cli.js"
   },
   "exports": {
     ".": {
@@ -48,6 +48,7 @@
     "pack:dry": "npm pack --dry-run",
     "release:check": "npm run typecheck && npm run build && npm run site:build && npm pack --dry-run",
     "site:build": "node scripts/build-site.mjs",
+    "version": "node scripts/sync-readme-version.mjs && git add README.md",
     "publish:public": "npm publish --access public --provenance"
   },
   "dependencies": {