Release security

Build a package once. Publish the same certified tarball. Do not rebuild during the privileged publication job.

Certification context

The certification job can check out source, install dependencies, run package scripts, test consumers, build packages, and create tarballs. It has no npm credential and no repository write permission.

Record the package name, version, file name, SHA-256 digest, npm SHA-1, and expected dist-tag in a release manifest. Retain the tarballs and manifest as an immutable CI artifact.

Publication context

The publication job downloads only the certified artifact. It does not check out the repository or install dependencies. It verifies the manifest and publishes the tarball with:

npm publish package.tgz --access public --tag latest --provenance --ignore-scripts

Use next instead of latest for a prerelease. Use npm trusted publishing through OIDC. Never add NPM_TOKEN.

GitHub release context

Create the tag and GitHub release only after npm publication succeeds. Read the exact version section from CHANGELOG.md. Attach or reference the certified artifact as required by the repository.

The GitHub release job needs repository write permission. It does not need npm permission.

Pin Actions

Pin every GitHub Action to a full, valid commit SHA. Dependabot can propose SHA updates. A copied but invalid SHA fails before the job starts, so verify the SHA against the action repository before merge.