pi-herdr-agents 0.0.1 → 0.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/RELEASING.md +1 -1
- package/package.json +1 -1
package/RELEASING.md
CHANGED
|
@@ -59,7 +59,7 @@ After the package exists on npm, steady-state releases use npm trusted publishin
|
|
|
59
59
|
- Workflow filename: `publish.yml`
|
|
60
60
|
- Allowed action: `npm publish`
|
|
61
61
|
3. Confirm the release job has `permissions.id-token: write` and runs on a GitHub-hosted runner (already set in `.github/workflows/publish.yml`).
|
|
62
|
-
4. Confirm the workflow uses
|
|
62
|
+
4. Confirm the workflow uses the exactly pinned Node `26.3.0`, whose bundled npm supports trusted publishing.
|
|
63
63
|
5. Publish stays tokenless: `npm publish --access public --provenance`.
|
|
64
64
|
|
|
65
65
|
When the repository secret `NPM_TOKEN` is absent, the publish step unsets `NODE_AUTH_TOKEN` and relies on OIDC. Once the package exists, the workflow fails if `NPM_TOKEN` is still configured, so steady-state releases cannot silently keep using the bootstrap credential.
|