Publishing is tag driven. The Publish workflow (.github/workflows/publish.yml) authenticates to npm with Trusted Publishing (OIDC). There is no npm token in the repo or its secrets. Never run npm publish by hand.

1. Bump the version in each package that changed.
2. Update CHANGELOG.md.
3. Merge to main.
4. Tag with the core package's version and push the tag:

git tag v2.4.0
git push origin v2.4.0

The tag must equal v plus the version in packages/dopaminejs/package.json, or the run fails before publishing.

1. npm ci
2. node scripts/check-versions.js (manifests)
3. npm run typecheck
4. npm run test:ci
5. Builds every package
6. node scripts/check-versions.js --dist (every declared entry point exists)
7. Checks the tag against the core version
8. node scripts/publish-changed.js

publish-changed.js publishes each package whose version is not on npm and skips the rest. A version bump is the release signal. Packages marked "private": true are left out.

Running the workflow again after a partial failure is safe. Packages already published are skipped.

Run the workflow from the Actions tab with dry run checked (the default). It does everything except publish, and lists what would be published.

A dry run also prints the OIDC claims the run presents and asks the registry for a token for every package that is not private:

Any response other than 201 fails the dry run and names the package. Do a dry run before the first release of a new package.

When the core version does not change, its tag already exists and there is nothing to push. Bump the package, merge to main, do a dry run, then run the workflow on main with dry run unchecked:

gh workflow run publish.yml --ref main -f dry_run=false

The tag check is skipped because the run is not on a tag. dopaminejs-themes 1.0.2 was published this way.

Each published package has a record on npm that names this repo and the workflow file publish.yml.

• Do not rename publish.yml.
• Do not add an environment: to the publish job.

Either one changes what the run presents to npm, and every package's record would have to be changed to match. A publish that fails with ENEEDAUTH usually means a record is missing or does not match.

Adding a record for a new package, with npm 12 or newer:

npm trust github <package> --repository BaryoDev/dopaminejs --file publish.yml --allow-publish --yes

The package has to exist on npm before a record can be added.

A package that has never been published has no record, and the dry run fails on it. Keep it "private": true until these are done, in order:

1. Publish a first version by hand, as a prerelease: npm publish --tag next --access public.
2. Add its record with the npm trust command above.
3. Remove the private line, merge, and do a dry run. It should return HTTP 201 for the package.
4. Publish the real version from the workflow.

dopaminejs-react 1.0.0 was published this way. Its hand-published bootstrap is 1.0.0-rc.0.

• Check the run in the Actions tab.
• Check npm view <package> version for each package that was bumped.
• Create the GitHub release from the tag, with the changelog section as its notes.