[Josh-a-e]

What's the point of this PR?

Verify package changes on pull requests, then publish a new stable npm version automatically after its release PR merges. Publishing uses npm trusted publishing with provenance, without a stored npm token.

The package remains at 0.1.0. That version already exists on npm, so this PR does not publish a release when merged.

Review scale

• Technical: 7. Controls npm publishing authority and artifact integrity.
• Product: 0. No package API or version change.

Decisions

• Merging the release PR is the only human approval.
• Build and test in a read-only job. Only the publish job can request an OIDC token; it installs no dependencies, checks out no source, and runs no package lifecycle scripts.
• Publish the tarball identified by the immutable, approved commit. A preflight check skips runs already superseded on main; a publication already in flight finishes before the next release. Refuse development/prerelease versions, version downgrades and registry failures; skip versions already published.

Verify by hand

Review the workflow and repository settings. Before the first new version, an npm owner must bind @vazen-ai/toml to GitHub owner vazen-ai, repository toml, workflow release-npm.yml, environment npm-release, and require 2FA while disallowing traditional tokens.

Machine record

Attestations

All four GitHub actions are pinned to full commits. Dependency caching is disabled. The publish job checks tarball hash, package identity, publishing configuration and current main commit. It publishes with --ignore-scripts --provenance, then waits for matching registry integrity and provenance metadata.

Main requires a PR and the up-to-date Verify npm package check, with no ruleset bypass or force pushes. The environment accepts the main branch only. Actions default to read, cannot approve PRs, and allow only the four named, pinned GitHub actions. The npm binding still needs owner setup.

Tests and type-checks

Public package verification passed: 139 tests, TypeScript, build and package lint. Release guards have 15 tests covering invalid versions, package identity, registry failures, duplicate versions and numeric version ordering. Workflow and shell lint passed. Local execution of release checking and packing correctly skips 0.1.0 and produces a package with the public source commit.

Public GitHub Actions verification passed: https://github.com/vazen-ai/toml/actions/runs/36917157231. Publishing correctly skipped on the PR. A temporary 0.2.0 tarball also passed npm publish dry-run on a clean directory; no version was published.

Escalations

The owner chose automatic publishing after merge, without another environment approval.

Copilot triage

A corresponding source review found that explicit --tag latest disables npm's backwards-version protection. The flag is removed; the final command passed another npm dry run.

Copilot suggested protected release tags to prevent main advancing between the preflight check and publishing. Noise for the chosen release policy: merging approves the immutable commit, and a later merge does not revoke an in-flight publication. Main releases are serialised and never cancelled. The description now states the preflight check's limit rather than implying it locks the branch. No writable release-tag permission is needed.

[Copilot]

Copilot review overview

🟡 Changes recommended

The current-main check has a race that can allow publishing an artifact after its commit is no longer current.

Review effort: Balanced
Findings: 1

Open (1)

• Prevent TOCTOU race between main check and npm publish · New

What changed in this PR

Adds automated npm release verification and trusted publishing with provenance.

Changes:

• Adds Effect-based release validation and unit tests.
• Builds, verifies, packages, and publishes approved releases through GitHub Actions.
• Validates package identity, integrity, source commit, and registry provenance.

File	Description
typescript/​check-release.ts	Validates release identity and version progression.
typescript/​check-release.unit.test.ts	Tests release validation and failure cases.
.github/​workflows/​release-npm.yml	Verifies and publishes npm artifacts using OIDC.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Josh-a-e]

Closing this draft because the direct-publication implementation is superseded. The replacement design is being reviewed in the canonical source repository before implementation begins. The revised workflow will stage the verified npm tarball after merge and require npm owner approval with 2FA. No version has been published by this PR.