GitHub and contributions

Use pull requests for changes to main. Keep rules strict enough to prevent an uncertified release, but small enough for a solo maintainer to operate.

Protect main

Require the repository's CI, security, and documentation deployment checks. Require the branch to be current before merge when the change can affect a release artifact. Do not permit force pushes or branch deletion.

Create a protected GitHub environment named npm for published libraries. Allow deployments only from main. Add at least one required reviewer. Do not store an NPM_TOKEN in the environment.

Use standard templates

Provide:

• a bug report,
• a documentation report,
• a focused feature request,
• private routing for security reports, and
• a pull request template.

The pull request template asks for purpose, verification, documentation, release note or Changeset, and risk. Require an issue before non-trivial features. Accept small, focused changes. State the project's contribution capacity honestly and politely.

Documentation feedback opens a prefilled GitHub issue and records the docs-feedback event when analytics is active.

Give Actions minimum permission

Set permissions explicitly. Use contents: read unless a job needs more. Give write permission only to the small job that performs the write.

Use these workflow names where they apply:

Release certification stays in the unprivileged first job of publish.yml. Do not add a second release workflow only to split the filename. The npm trusted publisher targets publish.yml. Treat a rename as a security setting migration. Update and verify the npm trust record before the next publication.

If a workflow creates version pull requests, enable Organization settings → Actions → General → Workflow permissions → Allow GitHub Actions to create and approve pull requests. This setting does not permit arbitrary writes. The workflow's own token permissions and branch rules still apply.

Keep credentials away from code

Use persist-credentials: false for checkout. Do not expose write credentials while repository code or dependency lifecycle scripts run. Never copy a token to a file to work around local keychain access.