dsh-plugin-scout 0.1.0 → 0.1.1

package/README.md

@@ -134,5 +134,5 @@ Based on the official repository's `docs/user/develop/basic/publish`, `docs/cook
 ## Releasing
 
 1. Bump `version` in `package.json` and commit.
-2. `git tag v<version> && git push --tags`. The `release` workflow runs the tests, runs `npm publish --provenance`, and attaches the same tgz to a GitHub Release. The repository needs an `NPM_TOKEN` secret (an npm Automation token).
+2. `git tag v<version> && git push --tags`. The `release` workflow runs the tests, runs `npm publish --provenance`, and attaches the same tgz to a GitHub Release. npm authenticates the workflow through Trusted Publishing (OIDC), so no npm token is stored in the repository; provenance is attached automatically. One-time setup on npmjs.com → package Settings → Trusted Publisher (GitHub Actions, workflow `release.yml`), or: `npx npm@latest trust github dsh-plugin-scout --file release.yml --repo fegnze/dsh-plugin-scout --allow-publish`.
 3. Keep the repository public with the `dsh-plugin` topic so it appears on https://github.com/topics/dsh-plugin and in Scout itself.

package/README.zh.md

@@ -132,5 +132,5 @@ npm test          # 先构建 lib/，再跑 core / host / client / manifest 四
 ## 发布
 
 1. 改 `package.json` 的 `version`，提交。
-2. `git tag v<version> && git push --tags`。`release` 工作流会跑测试，执行 `npm publish --provenance`，并把同一个 tgz 挂到 GitHub Release。仓库需要配置 secret `NPM_TOKEN`（npm 的 Automation token）。
+2. `git tag v<version> && git push --tags`。`release` 工作流会跑测试，执行 `npm publish --provenance`，并把同一个 tgz 挂到 GitHub Release。npm 通过可信发布（Trusted Publishing，OIDC）认证工作流，仓库里不存 npm token，provenance 自动附带。一次性配置：npmjs.com → 包 Settings → Trusted Publisher（GitHub Actions，工作流 `release.yml`），或：`npx npm@latest trust github dsh-plugin-scout --file release.yml --repo fegnze/dsh-plugin-scout --allow-publish`。
 3. 仓库保持 public，并带 topic `dsh-plugin`，这样才会出现在 https://github.com/topics/dsh-plugin，也能被 Scout 自己收录。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-scout",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Discover and verify DeepSeek Harness plugins from GitHub topic:dsh-plugin — usage categories, trust score, official peer compatibility; one-click install through the official installer (disabled by default)",
   "icon": "./icon.svg",
   "license": "MIT",