@uinaf/skillcheck 0.5.2 → 0.5.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/releasing.md +13 -4
- package/package.json +1 -1
package/docs/releasing.md
CHANGED
|
@@ -48,11 +48,20 @@ history continues from `v0.1.3`; `v0.1.0`–`v0.1.3` are the legacy git-install
|
|
|
48
48
|
tags and are never deleted or moved.
|
|
49
49
|
|
|
50
50
|
During preparation, `@semantic-release/npm` stages the released `package.json`
|
|
51
|
-
version and
|
|
52
|
-
|
|
53
|
-
|
|
51
|
+
version and `scripts/release-commit.ts` commits it through GitHub's signed
|
|
52
|
+
`createCommitOnBranch` API as the authenticated App. The checkout and expected
|
|
53
|
+
branch head are the verified workflow event SHA. GitHub atomically rejects the
|
|
54
|
+
write if `main` has advanced; a successful response is fetched by its immutable
|
|
55
|
+
commit SHA. The plugin checks its parent, unchanged source, and exact prepared
|
|
56
|
+
manifest before semantic-release tags it. Only the package version may change. The `[skip ci]` marker on that commit is what stops a release
|
|
54
57
|
from releasing itself.
|
|
55
58
|
|
|
59
|
+
If GitHub accepts the commit but fetching or validating it fails, preparation
|
|
60
|
+
stops before tagging or publishing. Inspect that commit's parent, tree, version
|
|
61
|
+
and verified signature, plus existing tags, npm versions and GitHub Releases,
|
|
62
|
+
before recovery. Reconcile only missing publication steps from the validated
|
|
63
|
+
commit; do not create another version or move an existing tag to hide failure.
|
|
64
|
+
|
|
56
65
|
Check what the next version would be without publishing anything:
|
|
57
66
|
|
|
58
67
|
```sh
|
|
@@ -61,7 +70,7 @@ pnpm dlx semantic-release --dry-run --no-ci
|
|
|
61
70
|
|
|
62
71
|
## The artifact
|
|
63
72
|
|
|
64
|
-
`dist/` is generated and untracked. `prepublishOnly` runs `pnpm run verify`,
|
|
73
|
+
`dist/` is generated and untracked. `prepublishOnly` runs `pnpm run verify:full`,
|
|
65
74
|
which builds it, so the tarball is always packed from a tree that just passed
|
|
66
75
|
the gate. `files` is `dist`, `docs`, `README.md`, `LICENSE`.
|
|
67
76
|
|