From 65c0d6ff101a6d220945aaf0023c9385adbda6dc Mon Sep 17 00:00:00 2001 From: TensorNull Date: Tue, 21 Jul 2026 21:09:56 +0800 Subject: [PATCH] Clarify Registry Alpha owner sequence --- RELEASING.md | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/RELEASING.md b/RELEASING.md index 113d57a..d7209be 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -80,8 +80,8 @@ corresponding release gate. Do not invent it or replace it with a mock. The `cometapi` package does not exist in the public registry yet, so npm cannot verify its owner before the first publication. Registry Alpha owner evidence is complete only when `npm owner ls cometapi` lists the maintainer-confirmed -`cometapi-team` account after bootstrap; until then this remains a Registry -Alpha prerequisite, not a Public Preview blocker. +`cometapi-team` account after the first publication; until then this remains a +Registry Alpha prerequisite, not a Public Preview blocker. For the current Public Preview milestone, authorized external actions remain limited to private pull requests and credential-free CI. Changing repository @@ -285,7 +285,18 @@ dist-tag. Before authorizing release: environment with OIDC and provenance, or use the one-time alpha.1 bootstrap only when normal Trusted Publishing cannot create the new package. The workflow selects `next`; no static package-manifest dist-tag participates. -11. Install `cometapi@next` from npm and run an independent import and mocked +11. After the first npm publication, an authorized maintainer adds the + company-controlled owner and verifies the resulting owner list: + + ```bash + npm owner add cometapi-team cometapi + npm owner ls cometapi + ``` + + Record evidence that the output lists `cometapi-team`; Registry Alpha owner + setup is incomplete until it does. + +12. Install `cometapi@next` from npm and run an independent import and mocked call before marking the alpha released. Enable Release Please only after the initial manual alpha is complete. @@ -309,17 +320,8 @@ one-time exception: `next` dist-tag, and fails if the token is absent when publication is needed. 3. That run verifies and publishes the exact artifact with public access and provenance, then verifies registry installation. -4. After the first publication, an authorized maintainer adds the - company-controlled owner and verifies the resulting owner list: - - ```bash - npm owner add cometapi-team cometapi - npm owner ls cometapi - ``` - - Record evidence that the output lists `cometapi-team`; Registry Alpha owner - setup is incomplete until it does. - +4. Complete the common Registry Alpha owner-verification step after this first + publication; the bootstrap does not change or defer that requirement. 5. A maintainer immediately configures OIDC, removes the environment variable and secret, revokes the token, and restricts token-based publishing. 6. The project immediately prepares and publishes `0.1.0-alpha.2` through