Skip to content

docs(releasing): list /runner; OIDC publishing is proven #90

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bjacobso merged 1 commit into from
Nov 12, 2026
Merged

docs(releasing): list /runner; OIDC publishing is proven #90

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions docs/releasing.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,10 @@ pnpm pack
The prepack hook builds the private module graph and dashboard, then emits one
`triplex-build-triplex-<version>.tgz`. It contains the existing core exports plus
`/sql`, `/sqlite`, `/postgres`, `/cloudflare`, `/foundationdb`, `/host`, `/http`,
`/testkit`, `/testkit/postgres` and `/mcp`, and the `triplex` executable. Dashboard
`/testkit`, `/testkit/postgres`, `/mcp` and `/runner`, and the `triplex` executable. Dashboard
JavaScript, CSS and fonts are prebuilt assets; consumers install no UI runtime.
Cloudflare and FoundationDB remain **experimental and frozen** even though their
subpaths now ship. `/runner` is reserved for later work and is not exported yet.
subpaths now ship.

Only `effect` is a required peer. Install the backend driver separately:

Expand Down Expand Up @@ -74,8 +74,10 @@ Allow direct `npm publish` for this workflow. It runs on a GitHub-hosted runner
## One-time npm bootstrap

npm package settings do not exist until the package has first been created. The seven public
packages were bootstrapped under `@triplex-build` with a short-lived token. Routine releases use
GitHub Actions OIDC without an npm token.
packages were bootstrapped under `@triplex-build` with a token, and 0.2.0 was still published with
it. Since 0.3.0, releases use GitHub Actions OIDC without an npm token: the publish job has no token
in its environment, and npm records provenance. The leftover `NPM_TOKEN` repository secret is no
longer used; delete it and revoke its token.

For a new package added to the family, repeat the minimal bootstrap sequence:

Expand Down
Loading