REL-001 — Complete npm bootstrap and Trusted Publishing activation #88

Summary

Complete the one-time administrative setup required to publish @diginodes/stellarforge-cli@0.1.0 through the protected OIDC workflow.

The original @stellarforge npm scope was unavailable. The permanent package identity is therefore @diginodes/stellarforge-cli, owned by the diginodes npm organization and aligned with the DigiNodes GitHub organization.

One-time npm namespace bootstrap

Use the reviewed bootstrap branch:

release/npm-bootstrap-0.0.0

Validated branch head:

8c2cf209eef97349a46cfb1dfb2002834c8e29b6

From an approved maintainer workstation:

git clone https://github.com/DigiNodes/stellarforge-cli.git stellarforge-cli-bootstrap
cd stellarforge-cli-bootstrap
git checkout 8c2cf209eef97349a46cfb1dfb2002834c8e29b6
npm ci --ignore-scripts --no-audit --no-fund
npm run build
npm run release:dry-run
npm login --auth-type=web --registry=https://registry.npmjs.org/
npm publish --access public --tag bootstrap

The bootstrap must create @diginodes/stellarforge-cli@0.0.0 under the non-default bootstrap dist-tag. npm also assigns latest to a package's first published version and currently rejects removing it with HTTP 400; the first OIDC release must move latest to 0.1.0.

Do not add an NPM_TOKEN to GitHub.

npm Trusted Publisher

After the package exists, configure:

• package: @diginodes/stellarforge-cli
• provider: GitHub Actions
• organization/user: DigiNodes
• repository: stellarforge-cli
• workflow: release.yml
• environment: npm-release
• direct npm publish: allowed

GitHub administrative controls

• create environment npm-release;
• require maintainer approval;
• restrict deployment to main;
• create repository Actions variable NPM_PUBLISH_ENABLED=false;
• change it to true only after bootstrap, Trusted Publishing, environment protection, and release-readiness changes are verified;
• keep Dependency Graph enabled so Dependency Review remains enforceable.

Activate 0.1.0 publication

After all controls are in place:

1. merge the reviewed release-readiness change;
2. verify the Release workflow enters publish mode;
3. approve the npm-release environment;
4. verify npm publishes @diginodes/stellarforge-cli@0.1.0;
5. verify the matching Git tag and GitHub Release exist;
6. verify npm provenance is displayed;
7. verify npm view @diginodes/stellarforge-cli version reports 0.1.0.

Acceptance Criteria

• bootstrap 0.0.0 exists under the bootstrap tag (npm temporarily also assigns latest to the first version);
• npm Trusted Publisher is configured;
• GitHub npm-release environment is protected;
• NPM_PUBLISH_ENABLED=true is configured only after verification;
• Dependency Graph is enabled and Dependency Review executes successfully;
• 0.1.0 publishes through OIDC without a long-lived npm token;
• npm package, Git tag, GitHub Release, and provenance agree on 0.1.0.

Security

Do not paste npm credentials, 2FA codes, private tokens, CLI authorization URLs, or secret material into this issue or CI logs.