Commit Graph
2 Commits
Author SHA1 Message Date
marc ee15ee0adf ci: stage releases for 2FA approval instead of publishing them
The npm trusted publisher may only stage, so a version goes live once a
maintainer approves it with 2FA. Staging needs npm 11.15 or later; Node 24.12
ships 11.6, so the job installs a pinned npm first.
2026-10-20 13:16:37 +02:00
marc 9b7003a691 ci: publish to npmjs on version tags with trusted publishing
No npm token: the workflow's OIDC identity is the npm trusted publisher, and
npm records provenance for the tag's commit.
2026-10-20 12:39:34 +02:00