From 5e82fdc13b44b7fd5ede94533af4142e01de6480 Mon Sep 17 00:00:00 2001 From: Kevin Boshold Date: Fri, 31 Jul 2026 09:36:32 +0200 Subject: [PATCH] docs(release): bump with npm version, matching the sibling repos The runbook told you to bump package.json, merge it, then tag separately. That is not how the other repos release and it is worse: two steps where npm version is one, with a window in between to tag the wrong commit. Verified rather than inferred from the commit subjects. ssm-secrets 3c70167b and nuxt-auth 6daf2ad0 are both single-parent, touch only package.json, carry the bare version as the subject and have zero associated pull requests, and each repo's tag points at that exact commit. Neither main is protected, so the direct push is allowed rather than a bypass. --- docs/release.md | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/docs/release.md b/docs/release.md index 028ce8e..e400fab 100644 --- a/docs/release.md +++ b/docs/release.md @@ -17,10 +17,20 @@ fails at publish on auth, having changed nothing. ## Cutting a release -1. Bump `package.json` to `X.Y.Z` and merge to `main`. -2. `git tag -a vX.Y.Z -m vX.Y.Z && git push origin vX.Y.Z` -3. `gh release create vX.Y.Z --title vX.Y.Z --generate-notes`, then **publish** - it. A draft triggers nothing. +From `main`, up to date. `npm version` bumps `package.json`, commits it with the +bare version as the subject, and tags that commit, so the bump and the tag cannot +drift apart. + +```sh +npm version minor # or patch / major +git push --follow-tags +gh release create vX.Y.Z --title vX.Y.Z --generate-notes +``` + +Then **publish** the release. A draft triggers nothing. + +The bump commit goes straight to `main`, no PR, matching `sidebase/ssm-secrets` +and `sidebase/nuxt-auth`. Publishing runs the workflow: checks out the tag, refuses if the tag and `package.json` version disagree, runs `typecheck` / `test` / `lint` / `build`