@ultikits/cli 2.0.0 → 2.0.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [2.0.1]
+
+### Changed
+
+- Release workflow now uses npm staged publishing via trusted publishing; no functional change. A tagged release
+  is staged on npm and becomes installable once a maintainer approves it on npmjs.com with 2FA.
+
 ## [2.0.0]
 
 ### Breaking

package/README.md

@@ -281,6 +281,56 @@ npm run build
 npm test
 ```
 
+## Releasing
+
+Releases are staged on npm by `.github/workflows/release.yml` through
+[npm Trusted Publishing](https://docs.npmjs.com/trusted-publishers) and
+[staged publishing](https://docs.npmjs.com/cli/v11/commands/npm-stage): the workflow's
+GitHub Actions OIDC token is exchanged for a short-lived credential, so no npm token is
+stored in the repository or its secrets. That credential can only stage a version; a
+maintainer makes it public by approving it with 2FA.
+
+1. Open a PR that bumps `version` in `package.json` (and `package-lock.json`, e.g. with
+   `npm version X.Y.Z --no-git-tag-version`) and adds the `CHANGELOG.md` entry.
+2. Merge it into `master` once CI is green.
+3. Tag the merge commit and push the tag:
+
+   ```bash
+   git checkout master && git pull
+   git tag -a vX.Y.Z -m "vX.Y.Z"
+   git push origin vX.Y.Z
+   ```
+
+4. The **Release** workflow builds, tests, refuses to continue unless the tag minus `v`
+   equals `package.json`'s version and that version is not yet on npm, upgrades npm to
+   at least 11.15.0, then runs `npm stage publish --access public`. The run's summary
+   shows the stage id. It can also be started by hand (Actions → Release → Run workflow)
+   with a `version` input that must equal `package.json`'s version.
+5. Approve the staged version: on npmjs.com open the `@ultikits/cli` package, find the
+   staged X.Y.Z, and approve it with your 2FA code (or run `npm stage approve <stage-id>`
+   while logged in). Until then the version is not installable and `latest` does not move.
+   A wrong build can be discarded with `npm stage reject <stage-id>`.
+
+### One-time npmjs.com setup
+
+On npmjs.com, open the `@ultikits/cli` package → **Settings** → **Trusted Publisher**,
+choose **GitHub Actions**, and enter:
+
+| Field | Value |
+|-------|-------|
+| Organization or user | `UltiKits` |
+| Repository | `ultikits-cli` |
+| Workflow filename | `release.yml` |
+| Environment name | *(leave empty)* |
+| Allowed command | **stage publish only** (`npm stage publish`; `npm publish` is refused) |
+
+After the first approved staged release, npm recommends setting **Settings →
+Publishing access** to "Require two-factor authentication and disallow tokens".
+
+Because this repository is private, npm does not attach a provenance attestation to
+releases ("Provenance generation is not supported for private repositories, even when
+publishing public packages"); trusted publishing itself still applies.
+
 ## License
 
 [MIT](LICENSE)

package/dist/bin/ultikits.js

@@ -12,7 +12,7 @@ const program = new Command();
 program
     .name('ultikits')
     .description('CLI for publishing UltiTools plugin modules to UltiCloud')
-    .version('2.0.0');
+    .version('2.0.1');
 registerLoginCommand(program);
 registerLogoutCommand(program);
 registerWhoamiCommand(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultikits/cli",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "CLI tool for publishing UltiTools plugin modules to UltiCloud marketplace",
   "type": "module",
   "bin": {