Stage npm releases from GitHub Actions by boatmeme · Pull Request #24 · growombud/prolly

10 / 10 tasks completed

All tasks have been completed

Task	Status
Confirm 2FA is on for the owning account. Approving staged versions requires it.	Completed
Add the trusted publisher: GitHub Actions, `growombud` / `prolly` / `publish.yml` / environment `npm`, allowed actions stage only. Do this before the first release. These fields can't be edited later.	Completed
After the first release, set Publishing access to "Require two-factor authentication and disallow tokens", and revoke old tokens.	Completed
Add a second npm maintainer. `boatmeme` is currently the only one, so approvals rest on one account.	Completed
`actionlint` is clean on both workflows	Completed
Tag and master checks run locally: a matching tag passes. A mismatched tag, a `v`-prefixed tag and a commit not on `master` are each rejected. A prerelease version maps to `next`.	Completed
`npm pack` output contains only `index.js`, `LICENSE`, `README.md` and `package.json`	Completed
`npm stage publish <tarball> --dry-run --tag next` accepts the packed tarball (npm 11.19)	Completed
`yarn ci-test` passes locally	Completed
First run after merge: release `0.5.5`, confirm it stages under `latest` with provenance attached, then approve or reject it	Completed