[macjayz]

What

A v* tag now publishes @heightproof/shared, @heightproof/sdk-node and @heightproof/web3 to npm in dependency order, alongside the images and Helm chart that release.yml already publishes.

• No npm token in GitHub. It uses npm trusted publishing (OIDC) with id-token: write.
• Provenance on every release. npm shows a verified "built from macjayz/heightproof by this workflow run" badge.
• Guards:
  • it fails if any package version, or any exact @heightproof/* pin between packages, differs from the tag
  • it skips versions already on npm, so a failed run is safe to re-run
• Dry run: you can trigger it manually from the Actions tab with dry_run (on by default).
• npm version: it upgrades npm to 11.21.1, because trusted publishing needs npm 11.5.1 or later and Node 22 bundles npm 10.

RELEASING.md documents cutting a release and the one-time setup. npm only allows a trusted publisher on a package that already exists, so the first 0.1.0 publish is done by hand.

Testing

• Parsed the workflow YAML, then extracted its steps and ran them locally:
  • the tag check passes for v0.1.0
  • it fails for v0.2.0 (version mismatch)
  • it fails for a stale internal pin
• Ran the publish step with DRY_RUN=true. All three packages pack in the right order.
• The real OIDC publish can only run on GitHub after the trusted publishers are configured.

🤖 Generated with Claude Code