@thespielplatz/tsp-tools-theme 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -8,6 +8,36 @@ Consumers pin a caret range and do not auto-update, so a release only reaches a
 that service's own spec says so. This package has no users of its own — every entry below is a
 change to eight apps at once, at the moment each of them chooses to take it.
 
+## v0.3.1
+
+[compare changes](https://github.com/inf0matics/tsp-tools-theme/compare/v0.3.0...v0.3.1)
+
+`0.3.1` exists to prove the automated release path end to end: `npm run bump-version` cuts it,
+a pushed tag publishes it over OIDC with no npm token anywhere. It contains no behaviour change —
+no consumer needs it.
+
+Provenance was attempted and abandoned: npm signs provenance only for a **public** source
+repository, and this one is private (`422 … Unsupported GitHub Actions source repository
+visibility: "private"`).
+
+### 🩹 Fixes
+
+- **ci:** Give the provenance check 10 minutes, not 200 seconds ([801182d](https://github.com/inf0matics/tsp-tools-theme/commit/801182d))
+- **ci:** Drop provenance — it requires a public repository
+- **ci:** Keep package-lock.json in step with the version on release
+
+### 🏡 Chore
+
+- Changelogen must not cut the GitHub release ([c564e71](https://github.com/inf0matics/tsp-tools-theme/commit/c564e71))
+
+### 🤖 CI
+
+- Ask for provenance explicitly, and verify it landed ([e96945a](https://github.com/inf0matics/tsp-tools-theme/commit/e96945a))
+
+### ❤️ Contributors
+
+- Inf0matics <philipp.horwath@gmail.com>
+
 ## v0.3.0 — 2026-09-22
 
 [compare changes](https://github.com/inf0matics/tsp-tools-theme/compare/v0.2.1...main)

package/README.md

@@ -358,7 +358,15 @@ rotate and none to leak. Two consequences worth knowing:
   and would silently look for a token that does not exist; trusted publishing needs npm ≥ 11.5.1
   and Node ≥ 22.14.0, and the step fails loudly rather than falling back.
 
-Provenance is automatic under trusted publishing — `--provenance` is not passed, and must not be.
+**There is no provenance, and that is not an oversight.** npm only signs provenance for a
+**public** source repository; this one is private, so npm skips the attestation. Asking for it
+explicitly does not produce one — it fails the publish with a 422 (`Unsupported GitHub Actions
+source repository visibility: "private"`), which is how the first `v0.3.1` attempt died. If this
+repository is ever made public, set `publishConfig.provenance` and restore the workflow step that
+checks the attestation actually landed.
+
+Trusted publishing is unaffected and is the substantive win either way: there is no token to
+leak, and the registry records the publisher as GitHub Actions over OIDC rather than a person.
 
 **`0.3.0` is a special case: it needs a tag, not a bump.** Its version was already written into
 `package.json` by hand (`0a5c793`) and its changelog entry is written, so two of changelogen's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thespielplatz/tsp-tools-theme",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "tsp.tools design-system theme as a Nuxt layer (Nuxt UI v4 + Tailwind v4): amber-on-anthracite tokens (light + dark), Nunito/Space Grotesk fonts, per-area colour mode, and the shared app shell. Use globally via `extends`, or scoped to a sub-area.",
   "author": "inf0matics",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "typecheck": "nuxi typecheck playground && nuxi typecheck scoped",
     "test:icons": "npm run build:playground && npm run build:scoped && node scripts/check-icons.mjs",
     "gate": "npm run lint && npm run docs:api:check && npm run typecheck && npm run test:icons && npm run test:e2e",
-    "bump-version": "npm run gate && changelogen --release && git push --follow-tags",
+    "bump-version": "npm run gate && node scripts/bump-version.mjs && git push --follow-tags",
     "release": "npm run gate && npm publish",
     "test:e2e": "playwright test",
     "test": "npm run test:icons && npm run test:e2e"