[donnes]

Problem

release.ts and publish.ts were rewritten in #7 but had never run. They used Bun-only APIs, so they weren't typechecked. Running the "Release & Publish" workflow in preview mode on this branch showed that releases were broken already, independent of this stack:

• The workflow checks out and pushes with the GH_PAT secret, which is now rejected (last successful release: 2026-02-19), presumably because it expired.
• The release script pushes the version-bump commit straight to main. main's ruleset requires reviewed, squash-merged PRs and only lets admin/maintain roles bypass that, so the workflow's own GITHUB_TOKEN can't replace the PAT.

Solution

• Plain Node scripts: both are now Node TypeScript, run with node, and included in tsconfig, oxlint and knip.
• Releases come from tags, not commits (like T3 Code):
  • The release job computes the next version from the latest v* tag and creates the tag and GitHub release through the API, with generated notes.
  • The publish job stamps that version into package.json before building and publishing with provenance.
  • Nothing is pushed to main, so GITHUB_TOKEN is enough and GH_PAT is no longer used. With trusted publishing, the repo needs no long-lived secrets.
• Version placeholder: package.json keeps 0.0.0-development, and the update notice skips that version.
• Preview runs every check plus an npm publish dry run of the next version, and creates nothing.

Stacked on #9.

Verification

• Preview in GitHub Actions on this branch: passes. It went v1.1.9 → v2.0.0, ran all checks including the pack-install-run check on npm 11, and ended with npm publish --dry-run at 2.0.0.
• Real release, rehearsed in a sandbox clone with a local bare remote and a stub gh: it called gh release create v2.0.0 --target <sha> --generate-notes and pushed nothing. The publish script stamped 2.0.0, and the built CLI reports 2.0.0.
• Incident during the rehearsal: my npm stub was shadowed by this machine's Node shim, so the rehearsal attempted a real npm publish. It failed: there was no npm login, and provenance needs GitHub's OIDC. The registry still shows 1.1.9 as latest. Publishing itself can only be verified with trusted publishing set up.

Before the first release

• Set up npm trusted publishing for @donnes/syncode → donnes/syncode, workflow publish.yml.
• Delete the GH_PAT and NPM_TOKEN secrets afterwards.

🤖 Generated with Claude Code