# Releases

The package name is `@jetserge/pi-read-full`. The workflow
`.github/workflows/publish.yml` publishes through npm trusted publishing, with
provenance. No npm token belongs in GitHub secrets.

## First release

After the repository is on GitHub and verification passes:

1. Run `npm login` from the checkout.
2. Run `npm publish --access public`.
3. In npm package settings, add the GitHub Actions trusted publisher: owner
   `CrazyCoder`, repository `pi-read-full`, workflow `publish.yml`. Leave the
   environment name empty.
4. Push the matching `v0.1.0` release tag after publication.

The initial manual publication makes npm's package settings available. The
workflow skips an already-published version, but still verifies the package and
creates the GitHub release for a tag push.

## Later releases

1. Update the package version and lockfile.
2. Run `npm run check`.
3. Run `npm run verify:tarball`.
4. Commit the verified changes.
5. Push `main` and the matching `v<version>` tag.

Every publishing run requires the matching version tag on the exact commit being
built. That commit must be reachable from `main`. The workflow runs only in
`CrazyCoder/pi-read-full`, not forks.

Manual workflow runs default to a dry run. Dry runs run verification but publish
nothing. The workflow uses npm 11 for trusted publishing and provenance.