@omkarux/vela 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -3,6 +3,27 @@
 All notable changes to this project are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.1] — 2026-09-10
+
+### Fixed
+- **The release workflow could never publish.** It triggered only on pushes to `main` and on pull
+  requests, while the publish job gated on `refs/tags/v*` — so a tag push matched no trigger and
+  the job never ran. Tags are now listed explicitly.
+- Trusted publishing requires npm >= 11.5.1; Node 22 ships npm 10.x. The publish job now upgrades
+  npm first. Without it npm falls back to looking for a token and fails with `ENEEDAUTH`, which
+  reads like a credentials problem rather than a version one.
+
+- **`scripts/verify-pack.mjs` crashed on `npm pack --json`.** It assumed an array and indexed
+  `[0].filename` directly, which threw a bare `TypeError` when npm returned a different shape from
+  inside a lifecycle script. It now parses defensively and reports the actual output.
+- The publish job no longer re-runs the full gate. `prepublishOnly` fired inside `npm publish`,
+  repeating work the `verify` job had already done and putting a second failure surface inside the
+  publish step — which is what broke the first tagged release. The gate runs once, in `verify`.
+
+This release exists to prove the pipeline end to end. The tarball contents are unchanged from
+0.3.0 — but this one was built and published by CI from a git tag, with a provenance attestation
+tying it to the commit, rather than by hand from a laptop.
+
 ## [0.3.0] — 2026-09-10
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omkarux/vela",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "A token-first React component kit: two-layer color architecture, separate severity and risk taxonomies, full light and dark theming, zero runtime dependencies.",
   "type": "module",
   "license": "MIT",