Docs accuracy: ci-setup.md and examples/ci READMEs #745

Accuracy fixes for packages/release/docs/ci-setup.md and the examples/ci/ READMEs. The bigger workflow bugs are in #739, and the scope and label-trigger problem is in #731.

OIDC

• :846-852, examples/ci/oidc/README.md:17, release.yml:7 npm trusted publishing needs npm ≥ 11.5.1, not 9.5.0 (verify). Node 22 ships npm 10.
• :313, :446, :677 contradict :825. npm allows one trusted publisher per package, so a separate release.yml can't coexist with standing-pr.yml publishing.
• :854-876 says "delete the file" but has no step for it. Decide whether rm -f .npmrc is needed at all, since publish already isolates NPM_CONFIG_USERCONFIG (publish/src/utils/npm-env.ts:60-93). Then make getting-started, docs/action.md:25 and the examples agree.
• :852 "Automation policy" → "trusted publisher".

Labels and triggers

• :81 and examples/ci/label-driven/README.md:12 release:skip works in commit mode only.
• :15-62 Show ci.releaseTrigger; its default is label.
• :217 "scope:docs": "docs/**" looks like a path, but patterns match package names.
• :233 --scope and --target aren't mutually exclusive; --scope overwrites the target.
• :383, :420 The list of release-control labels leaves out release:graduate and graduate:<pkg>.

Standing PR

• :366-380 The options table is stale. Link docs/configuration.md#cistandingpr instead.
• :374 mergeMethod only affects standing-pr merge. Enforce squash through the repo's allowed merge methods, because a UI merge commit doesn't match the skip pattern.
• Lifecycle text is stale:
  • :675 a new PR is created; the old one doesn't "reopen";
  • :794, :816 preview notes now update on labeled;
  • :802 edited events trigger rebuilds.
• :689-708 Pushes made with GITHUB_TOKEN don't trigger workflows. The real gotcha is that required checks never report on the standing PR.
• :748-752 The selection checklist requires sync: false or groups, and sync is the default. Drop the --sync example (:986-991).
• :677 The default release commit message carries no skip-ci marker.
• :783 Renaming ci.labels.retry also means editing the hard-coded label in the DELETE step (:658).
• :719 The condition is (failure() || cancelled()).

Direct mode

• :56-61, :178-182, :298-299 runRelease already refreshes previews in-process, so drop the extra step. The pull-requests: write permission is there for the failure report, not for the refresh.
• :968 The prerelease snippet inlines ${{ inputs.prerelease }} into shell. Use an env var, as the example does, and add a permissions block.
• :11 Node 22.12+. :10, :784 Releases are drafts by default.
• :205 Link docs/configuration.md#ci, not README#ci-configuration (which documents the removed defaultScope).
• :890-934 Replace the pub.dev block with a link to docs/dart.md#auth.
• :810 Drop the historical "too many arguments" row.

examples/ci

• prerelease (README:25-26, releasekit.config.json:14): npm.tag doesn't set the prerelease dist-tag, because the identifier is used (publish/src/utils/semver.ts:7-14). It also sends stable releases to next. Drop it.
• prerelease README:22-24 releaseStrategy: "manual" doesn't stop auto-firing; the trigger does.
• monorepo-rust README:22-23 publish.cargo.enabled defaults to true.
• standing-pr README:11, :46 Fix the trigger types: update also fires on labeled, unlabeled and edited.
• label-driven: on pull_request: closed from a fork, the token is read-only and secrets are withheld. Note this, or switch to push + gate (Direct release: releasekit release throws "No scope specified" after PR merges and ignores bump labels, so the documented workflows break #731).
• examples/README.md:7-9, 68-82 The validation doesn't exercise a token or PR context (Direct release: releasekit release throws "No scope specified" after PR merges and ignores bump labels, so the documented workflows break #731).
• Pins: the docs, examples and templates use checkout and setup-node @v6, while action.yml and the repo's workflows use @v7.

Found in the 2026-10-23 docs review.