# StormFetch Release Security Checklist

Run this checklist before publishing:

1. `npm ci`
2. `npm run typecheck`
3. `npm run build`
4. `npm audit --omit=dev --audit-level=moderate`
5. `npm run security:test`
6. `npm pack --dry-run`
7. Inspect package contents for unexpected files.
8. Review `SECURITY_DENYLIST.md` before adding or upgrading build dependencies.
9. Generate and attach an SBOM from CI.
10. Prefer the GitHub Actions OIDC/provenance workflow for public releases.
11. After publish, verify with `npm audit signatures`.
12. Confirm every workflow `uses:` reference is pinned to a full commit SHA.
13. Keep checkout credential persistence disabled and CI dependency caches off unless a reviewed threat model explicitly allows them.

Recommended consumer check:

```bash
npm audit signatures
```

This confirms npm provenance/signatures where available. It does not prove the code has no bugs; it confirms the package was not silently replaced outside the expected publishing path.

## Publishing paths

| Path | Command | Provenance | When to use |
| --- | --- | --- | --- |
| Recommended CI release | `npm publish --provenance --access public` | Yes, through GitHub Actions OIDC | Normal public releases |
| Local manual release | `npm publish --access public` | No automatic provenance | Emergency/manual release with npm token or OTP |

Do not force `provenance` in `package.json` `publishConfig`. A local shell has no supported CI identity provider, so npm reports `Automatic provenance generation not supported for provider: null`. The GitHub Actions workflow enables provenance explicitly and has `id-token: write` permission.