Skip to content

docs: describe release notes for behavior changes and the tokenless publish workflow #225

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sadjow merged 2 commits into from
Oct 14, 2026
Merged

docs: describe release notes for behavior changes and the tokenless publish workflow #225

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
472c172
docs: describe release notes for behavior changes and the tokenless p…
sadjow Oct 14, 2026
127c45e
Merge remote-tracking branch 'origin/main' into docs/release-token-wo…
sadjow Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion docs/RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,8 @@ flowchart TD

The script leaves the tag and the GitHub Release to the merge workflow, which creates them on the merge commit. A tag pushed before the merge would point at the release branch, and the workflow stops instead of releasing from it.

changelogen lists each commit by its title. When the release changes behavior that consumers may need to act on, such as which visits count as campaigns or which fields an entry stores, add a short note to the new `CHANGELOG.md` section and amend the release commit before pushing.

5. Push the release branch:

```bash
Expand All @@ -91,7 +93,7 @@ Because every run releases the release commit rather than the latest commit on `

## npm Trusted Publishing

The workflow publishes through [npm trusted publishing](https://docs.npmjs.com/trusted-publishers), so the repository stores no npm token. npm exchanges the workflow's GitHub OIDC token for a short-lived publish token and generates provenance for the release. Only the publish job can request that OIDC token, and it publishes the tarball an earlier job built, so dependency install and build scripts never run with publish access.
The workflow publishes through [npm trusted publishing](https://docs.npmjs.com/trusted-publishers) and needs no npm token. npm exchanges the workflow's GitHub OIDC token for a short-lived publish token and generates provenance for the release. Only the publish job can request that OIDC token, and it publishes the tarball an earlier job built, so dependency install and build scripts never run with publish access.

This relies on a trusted publisher configured for the `nuxt-utm` package on npmjs.com:

Expand Down
Loading