Skip to main content

First release checklist

Bootstrap a new npm package and prove its permanent release path.

Use this checklist for each new package name.

Before publication

  • The version and dist-tag are correct.
  • Protected main contains the release commit.
  • Full release certification passed at that exact commit.
  • The retained artifact contains the tarball and manifest.
  • Local artifact hashes match CI.
  • The npm package name is available and owned by the correct scope.

Bootstrap

  • The exact certified tarball was published with public access and scripts disabled.
  • Stable versions use latest; prereleases use next.
  • The public npm SHA-1 matches the manifest.
  • No local rebuild occurred.
  • The absence of OIDC provenance on this first version is recorded.

Trusted publishing

  • The trusted publisher uses the exact repository.
  • The workflow file is publish.yml.
  • The environment is npm.
  • Direct publish permission is enabled.
  • The trust record was listed and checked.
  • No NPM_TOKEN exists in the repository, organization, or environment.

Public record

  • The Git tag points to the release commit.
  • The GitHub release uses the correct changelog section.
  • A clean consumer can install and use the package.
  • The npm README and repository links render correctly.
  • A later patch release has proved OIDC provenance and the normal workflow.