blitz-pdf 0.1.0 → 0.1.1

package/README.md

@@ -315,7 +315,7 @@ npm pack
 The wasm-bindgen CLI version must match `Cargo.lock`. Dependencies and upstream
 commits are locked. `npm pack` verifies artifacts and renders a PDF before making
 the tarball; it does not publish. Install locally using
-`npm install ./blitz-pdf-0.1.0.tgz`.
+`npm install ./blitz-pdf-<version>.tgz`.
 
 The pinned Stylo source in `vendor/stylo` enables paged-media properties in the
 Servo build; `vendor/README.md` records the small patch. Its MPL-2.0 source is
@@ -328,6 +328,42 @@ For browser verification, run `npm run test:browser` and open
 `http://127.0.0.1:4173`. CI builds WASM, runs Bun and Node tests, validates the
 captured PDFs with veraPDF, benchmarks, and packs an npm artifact.
 
+## Publishing releases
+
+Push a tag matching the package version, such as `v0.1.1`, to start
+[Publish to npm](https://github.com/iteufel/blitz-pdf/actions/workflows/publish.yml).
+The workflow checks that the tag, npm manifests, and root Rust package versions
+agree. It then builds WASM from source, runs the Bun and Node tests, validates
+PDF/A-3u with veraPDF, runs benchmarks, and publishes the verified archive.
+Release builds do not restore dependency or compiler caches.
+
+Publishing uses [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/)
+with GitHub OIDC and provenance. The npm trust must permit direct publishing from
+`iteufel/blitz-pdf`, workflow `publish.yml`, with no environment restriction.
+No `NPM_TOKEN` repository secret is needed. Stable versions use the npm `latest`
+tag; prereleases use `next`. After publishing, the workflow checks that npm serves
+the exact archive it built, comparing SHA-512 integrity.
+
+For the next patch release:
+
+1. Run `npm version patch --no-git-tag-version` to update both npm manifests.
+2. Set the same version in `Cargo.toml` and the `blitz-pdf-wasm` entry in
+   `Cargo.lock`.
+3. Commit the changes, create the matching Git tag, and push both:
+
+```sh
+git add package.json package-lock.json Cargo.toml Cargo.lock
+RELEASE_VERSION=$(node -p "require('./package.json').version")
+git commit -m "chore: release $RELEASE_VERSION"
+git tag "v$RELEASE_VERSION"
+git push origin main "v$RELEASE_VERSION"
+```
+
+To retry a failed release, rerun its GitHub Actions run or use
+`gh workflow run publish.yml --ref v0.1.1`. Manual runs require a matching version
+tag too. Published npm versions cannot be overwritten; subsequent releases need
+a new version.
+
 ## Performance benchmarks
 
 ```sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitz-pdf",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Render HTML and CSS to PDF with Blitz and WebAssembly in Node.js, Bun, and browsers.",
   "type": "module",
   "license": "MIT",