@rose42/t3-feedback 0.1.0 → 0.1.1

package/README.md

@@ -480,37 +480,18 @@ pnpm dev
 
 ## Release
 
-Releases are driven by **version tags** (`vX.Y.Z`). Pushing a tag runs CI: verify → GitLab Release (dist tarball in the package registry) → publish to public npm.
+Releases are driven by **version tags** (`vX.Y.Z`). Pushing a tag runs CI: verify → GitLab Release (dist tarball in the package registry) → publish to public npm via **OIDC trusted publishing** (no `NPM_TOKEN`).
 
 CI installs `@rose42/feedback-capture@0.1.0` from npm. Local/devcontainer work
 symlinks a sibling [`feedback-capture`](https://gitlab.com/rose42/feedback-capture) clone
 into `node_modules` without changing the declared dependency.
 
-### One-time npm + GitLab setup
-
-1. Create or join the **`rose42`** org on [npmjs.com](https://www.npmjs.com) with permission to publish `@rose42/*`.
-2. Create an npm **Automation** (or granular) access token with publish rights for `@rose42/t3-feedback` (or the whole `@rose42` org).
-3. In GitLab: **Settings → CI/CD → Variables** → add:
-   - Key: `NPM_TOKEN`
-   - Value: the token
-   - Flags: **Masked**; use **Protected** only if `v*` tags are protected (otherwise leave Protected off so tag pipelines can read it).
-4. Optional local check: `pnpm login` then `pnpm publish --dry-run --access public`.
-
-### Cut a release
-
-Requires a clean git worktree. Bumps `package.json`, commits, tags `vX.Y.Z`, and pushes (with `--follow-tags`) so the tag pipeline runs. Ensure `NPM_TOKEN` is set in GitLab before the first publish.
+See [docs/release.md](docs/release.md) for trusted-publisher setup, post-publish hardening, and cutting a release:
 
 ```bash
-pnpm release -- 0.1.0    # first release
-# later:
-pnpm release -- patch    # or: minor | major
+pnpm release -- patch    # or 0.1.1 / minor / major
 ```
 
-After the pipeline succeeds:
-
-- npm: [`@rose42/t3-feedback`](https://www.npmjs.com/package/@rose42/t3-feedback)
-- GitLab: **Deploy → Releases** (asset links to the generic package tarball)
-
 ## License
 
 MIT © Rose42

package/docs/release.md

@@ -0,0 +1,47 @@
+# Release
+
+Releases are driven by **version tags** (`vX.Y.Z`). Pushing a tag runs CI:
+
+**verify** → **GitLab Release** (dist tarball in the package registry) → **npm publish** via OIDC trusted publishing.
+
+CI uses the `node:24` image (npm ≥ 11.5.1). Publish must run on **GitLab.com shared runners** — self-hosted runners are not supported for npm OIDC.
+
+## One-time npm trusted publisher setup
+
+1. Create or join the **`rose42`** org on [npmjs.com](https://www.npmjs.com) with permission to publish `@rose42/*`.
+2. On the package page for [`@rose42/t3-feedback`](https://www.npmjs.com/package/@rose42/t3-feedback): **Settings → Trusted Publishing → GitLab CI/CD**. Configure (values are case-sensitive):
+   - **Namespace**: `rose42`
+   - **Project name**: `t3-feedback`
+   - **Top-level CI file path**: `.gitlab-ci.yml`
+   - **Environment name**: leave empty (this pipeline does not use GitLab environments)
+   - **Allowed actions**: at least `npm publish`
+3. Do **not** add an `NPM_TOKEN` CI variable or write `_authToken` into `.npmrc` for publish. The `publish` job requests `NPM_ID_TOKEN` (audience `npm:registry.npmjs.org`); the npm CLI exchanges that OIDC token for a short-lived publish credential. A fallback token overrides OIDC and breaks the flow.
+4. Optional local check: `pnpm login` then `pnpm publish --dry-run --access public`.
+
+### After the first successful tag publish
+
+1. In GitLab: **Settings → CI/CD → Variables** — remove `NPM_TOKEN` if it still exists (or stop using it).
+2. Optionally on npm → package **Settings → Publishing access**: require 2FA and disallow tokens.
+
+## Cut a release
+
+Requires a clean git worktree. Bumps `package.json`, commits, tags `vX.Y.Z`, and pushes (with `--follow-tags`) so the tag pipeline runs.
+
+```bash
+pnpm release -- 0.1.0    # first release (exact version)
+# later:
+pnpm release -- patch    # or: minor | major
+```
+
+After the pipeline succeeds:
+
+- npm: [`@rose42/t3-feedback`](https://www.npmjs.com/package/@rose42/t3-feedback)
+- GitLab: **Deploy → Releases** (asset links to the generic package tarball)
+
+## CI publish job (OIDC)
+
+The `publish` job in [`.gitlab-ci.yml`](../.gitlab-ci.yml):
+
+- Requests `NPM_ID_TOKEN` with `aud: "npm:registry.npmjs.org"`
+- Optionally requests `SIGSTORE_ID_TOKEN` with `aud: sigstore` for provenance
+- Runs `pnpm publish --access public --no-git-checks` with **no** `~/.npmrc` `_authToken`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rose42/t3-feedback",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "description": "DEV-only: capture app feedback and send it to a T3 Code thread (unofficial community tool)",
   "license": "MIT",
@@ -58,27 +58,9 @@
     "docs",
     "!dist/**/*.map"
   ],
-  "scripts": {
-    "dev": "tsc -p tsconfig.build.json --watch",
-    "build": "rm -rf dist && tsc -p tsconfig.build.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "lint": "eslint .",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "release": "bash scripts/release.sh",
-    "prepublishOnly": "pnpm typecheck && pnpm lint && pnpm test && pnpm build"
-  },
   "engines": {
     "node": ">=24"
   },
-  "packageManager": "pnpm@10.21.0",
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild"
-    ]
-  },
   "dependencies": {
     "@rose42/feedback-capture": "0.1.0",
     "ws": "^8.18.3"
@@ -103,5 +85,16 @@
     "typescript-eslint": "^8.46.4",
     "vite": "^7.0.0",
     "vitest": "^3.2.7"
+  },
+  "scripts": {
+    "dev": "tsc -p tsconfig.build.json --watch",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint .",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "release": "bash scripts/release.sh"
   }
-}
+}