Release config reads as publish-disabled but does publish to npm

[camcima]

Problem

.release-it.json contains:

"npm": { "publish": false },
"plugins": {
  "@release-it/conventional-changelog": { ... },
  "release-it-pnpm": {}
}

That reads as "this pipeline does not publish to npm." It does. npm.publish: false only disables release-it's built-in npm plugin; release-it-pnpm performs its own Publishing packages(s) step, which that setting does not gate — and neither do the --no-git.* / --no-github.release flags, so there is no obvious way to do a partial or rehearsal run that stops short of publishing.

Publishing on pnpm release is the correct behavior. The problem is that the configuration states the opposite, so anyone reasoning about the pipeline from the config file will conclude that a run is safe when it will in fact push six public packages to the registry. --dry-run does not make it obvious either: it prints Publishing packages(s) with no indication of what that resolves to.

Suggested fix

Some combination of:

• A comment or README/CONTRIBUTING note stating plainly that pnpm release publishes all six packages to npm, and that npm.publish: false refers only to the built-in plugin.
• Removing npm.publish: false if it is inert, or keeping it with an adjacent comment explaining what it does and does not cover, so it stops reading as a global switch.
• Documenting how to rehearse a release without publishing, if release-it-pnpm supports it (--no-plugins, or dropping the plugin for the rehearsal).

Context

Hit during the 0.3.0 release: an intended generate-only run (--no-git.commit --no-git.tag --no-git.push --no-github.release) published all six packages before the changelog had been reviewed. The published artifacts were correct and 0.3.0 shipped fine, but the ordering was not what the operator intended, and the config is why.