# Releasing to npm

This repository publishes `pi-goal-list-loop-audit` through the GitHub Release
workflow at `.github/workflows/publish.yml`.

## One-time npm setup

In npm package settings, add a **Trusted Publisher** for:

- GitHub owner/repository: `DraconDev/pi-goal-list-loop-audit`
- workflow file: `.github/workflows/publish.yml`
- environment: leave unset unless the repository deliberately protects the job
  with an npm environment

The workflow uses npm OIDC provenance. Do not add a long-lived `NPM_TOKEN` to
the repository.

## Release checklist

```bash
npm version <major.minor.patch> --no-git-tag-version
npm run release:check
# review the diff, then commit package.json + package-lock.json + changelog
# create and push the matching tag, for example:
git tag v<major.minor.patch>
git push origin main v<major.minor.patch>
```

Create a GitHub Release from that tag. Publishing happens only after the
release is marked **published**; the workflow checks that the tag equals the
`package.json` version, runs the complete test/typecheck/package inspection,
and then runs:

```bash
npm publish --provenance --access public
```

Verify availability from a separate machine or shell:

```bash
npm view pi-goal-list-loop-audit version dist-tags.latest
npm install -g pi-goal-list-loop-audit
# or in pi:
pi install npm:pi-goal-list-loop-audit
```

`publishConfig.access=public` is necessary for the scoped/public policy, but
it does not publish anything by itself. A commit, tag, or GitHub Release alone
is not proof that npm has the package; the registry check above is the proof.