3 people 243ef1d3e2 ci(release): switch npm publishing to OIDC trusted publishing; document verified releases (#1298) ...

All seven published packages (@colbymchenry/codegraph + six platform
bundles) now have this repo's release.yml configured as their trusted
publisher on npmjs.com, so publishes authenticate via the workflow's
OIDC identity instead of a long-lived NPM_TOKEN. The runner upgrades to
npm 11 (trusted publishing needs >= 11.5; Node 22 bundles npm 10) and
setup-node no longer writes a token-referencing .npmrc.

README gains a 'Verified releases' section + badges: how npm provenance
and the GitHub Release attestations work and the commands to verify them
(npm audit signatures / gh attestation verify).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-07-15 19:23:31 -05:00

..

workflows

ci(release): switch npm publishing to OIDC trusted publishing; document verified releases (#1298)

2026-07-15 19:23:31 -05:00