@thomas-huang/caosi 0.1.0 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +11 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -107,4 +107,14 @@ go test ./...
|
|
|
107
107
|
|
|
108
108
|
Domain language: [CONTEXT.md](CONTEXT.md). Decisions: [docs/adr](docs/adr).
|
|
109
109
|
|
|
110
|
-
To cut a release, push a tag `vX.Y.Z
|
|
110
|
+
To cut a release, push a tag `vX.Y.Z`. GitHub Actions builds the five binaries, writes checksums, creates the Release, and publishes `@thomas-huang/caosi` to npm with GitHub OIDC trusted publishing (no access token).
|
|
111
|
+
|
|
112
|
+
On npmjs.com, open package `@thomas-huang/caosi` → Trusted Publisher and set **exactly**:
|
|
113
|
+
|
|
114
|
+
- Publisher: GitHub Actions
|
|
115
|
+
- Organization or user: `thomas-huang`
|
|
116
|
+
- Repository: `caosi` (not `thomas-huang/caosi`)
|
|
117
|
+
- Workflow filename: `release.yml` (filename only, not `release` and not `.github/workflows/release.yml`)
|
|
118
|
+
- Environment: leave empty (this workflow does not set `environment:`)
|
|
119
|
+
|
|
120
|
+
`OIDC permission denied for this action` means the token was issued but those fields did not match. Provenance can still succeed; the PUT to the registry is what npm authorizes.
|
package/package.json
CHANGED