Colby MchenryandClaude Fable 5 243ef1d3e2 ci(release): switch npm publishing to OIDC trusted publishing; document verified releases (#1298) ...

All seven published packages (@colbymchenry/codegraph + six platform
bundles) now have this repo's release.yml configured as their trusted
publisher on npmjs.com, so publishes authenticate via the workflow's
OIDC identity instead of a long-lived NPM_TOKEN. The runner upgrades to
npm 11 (trusted publishing needs >= 11.5; Node 22 bundles npm 10) and
setup-node no longer writes a token-referencing .npmrc.

README gains a 'Verified releases' section + badges: how npm provenance
and the GitHub Release attestations work and the commands to verify them
(npm audit signatures / gh attestation verify).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-07-15 19:23:31 -05:00

..

deploy-site.yml

Add landing page + Starlight docs site (#375)

2026-05-24 13:21:25 -05:00

release.yml

ci(release): switch npm publishing to OIDC trusted publishing; document verified releases (#1298)

2026-07-15 19:23:31 -05:00