Release pipeline
Package verification, GitHub artifacts, npm OIDC, and release authorization.
Release authorization
The release workflow accepts an exact chore: release x.y.z or chore: release x.y.z-tag.n
commit on main, either through a push or a manual workflow dispatch for that commit.
Only repository collaborators with current write, maintain, or admin access may
release. Both the original workflow actor and the actor initiating a rerun must qualify.
Commit author names and emails do not grant permission.
CI verifies access through GitHub's repository permission API before marking a run as a release,
and again before changing tags or drafts, uploading assets, publishing npm packages, or making
the GitHub release public. Missing identities, insufficient access, and API failures block release
actions. Normal pushes, pull requests, and manual dispatches without a release commit continue to
run their existing checks. Releases remain restricted to main.
Package publication
The release publisher verifies this package is present before publishing and reuses an
already published exact version when resuming an interrupted release. Configure npm Trusted
Publishing for @remedia/plugin-host with the same twlite/remedia repository and ci.yaml
workflow as the other release packages. Publishing uses npm OIDC Trusted Publishing.