[Be1newinner]

Summary

Automates npm releases. Every release is staged on npm and goes live only after the maintainer approves it on npmjs.com, with 2FA.

Bump	How
Patch x.y.Z	Automatic. Every push to main that changes src/, packages/ or package.json runs CI and, if it passes, stages the next patch.
Minor x.Y.0	Maintainer approval only: Actions → Release → Run workflow → bump: minor. Restricted to the repo owner.
Major X.0.0	Never automated. The script rejects it.

• Publishing method: npm stage publish with npm trusted publishing (OIDC). npm recommends stage-only trusted publishers. No token is stored, and provenance is generated.
• Approval: after staging, approve on npmjs.com (Staged Packages tab) or with npm stage approve <stage-id>. Reject with npm stage reject <stage-id>.
• Tag and release: when a version is staged, it gets a vX.Y.Z tag and a draft GitHub release listing the shipped commits. The job summary shows how to approve.
• Pending approvals: a staged version can't be staged again. The previous release is the highest of npm's published version and the v* tags, so a push made while a release is still waiting stages the next patch instead of failing.
• What triggers a release: template changes do. Since feat: CLI flags, feature generator, validation, OpenAPI docs, Docker and Drizzle #20 the template ships inside the npm package. Docs-, CI- and test-only changes don't.
• CI: ci.yml is now reusable. Pushes to main run it through release.yml, and staging only happens after it passes.
• Version in the repo: package.json's version isn't committed back; the workflow sets it at release time. CONTRIBUTE.md documents the process.

After merging

• The merge stages 3.0.1 (everything from feat: CLI flags, feature generator, validation, OpenAPI docs, Docker and Drizzle #20). Approve it on npmjs.com to make it live.
• To ship it as 3.1.0 instead, reject the staged 3.0.1, then run the workflow manually with bump: minor.
• The trusted publisher only needs staging, which is always allowed. The dist-tag permission isn't used.

Test plan

• Version script on the real repo: 3.0.0 → 3.0.1 from the 2 shipped commits since 5fab950
• Scratch-clone scenarios:
  • docs-only push → no release
  • fix: → patch
  • feat!: with BREAKING CHANGE → still patch
  • manual minor → 3.1.0
  • manual major → rejected
  • push while v3.0.1 is staged but npm still says 3.0.0 → 3.0.2
• npm stage publish --dry-run --access public accepts the flags and packs 67 files (51 kB)
• Both workflows parse
• The first real run, after merging

🤖 Generated with Claude Code

https://claude.ai/code/session_015pLhuJbdhCyvDro7o6h1wp