Skip to main content

Normal release

Release a stable package from one certified artifact through the protected workflow.

Use the repository's release workflow after the first npm bootstrap.

Prepare the change

Use Conventional Commits where the repository requires them. Add the required Changeset or release note. Update public documentation in the same pull request. Run pnpm verify before handoff.

Prepare the version

Use the repository's protected version process. Changelogen updates the version and CHANGELOG.md. The process creates a version pull request when the repository uses one. Do not run changelogen --release --push locally.

Review the version, changelog section, package list, and dist-tag. Merge only after required checks pass.

Certify and approve

Trigger the protected release workflow from main when the repository requires a manual dispatch. The unprivileged job builds and certifies the exact tarball. Review the artifact evidence. Approve the protected npm environment.

Verify publication

Confirm:

  • the expected version exists on npm,
  • stable releases use latest,
  • the public SHA-1 matches the certified tarball,
  • npm displays provenance,
  • the package README renders correctly,
  • the Git tag points to the release commit, and
  • the GitHub release contains the exact changelog section.

Install the package in a clean temporary consumer when package boundaries or runtime behavior changed.