diff --git a/README.md b/README.md index 9572779e6..b6ca767c4 100644 --- a/README.md +++ b/README.md @@ -157,7 +157,7 @@ Release configuration is **only** at the root. The orchestrator sets `tagFormat` If a release job is itself cancelled by its own timeout after the per-package publish work has already completed but before it collects the released tags into those three matrices, a plain re-run cannot recover it: the collection step diffs tags against a before/after snapshot taken within that same run, so a later run sees every already-existing tag as pre-existing, not new. `ci.yml`'s `workflow_dispatch` trigger takes an optional `backfill_tags` input (comma- or newline-separated `name@version` tags) for exactly this case: a `collect-backfill-matrix` job builds the identical three matrices directly from the given tags, without re-running the release itself, and the three post-release jobs consume whichever of it or the normal release job produced output. Trigger it with `gh workflow run ci.yml --field backfill_tags="pkg-a@1.2.3,pkg-b@4.5.6"`. -One user-only action remains before the npm aliases resume tracking their packages: each alias name's trusted publisher must be registered once against this repository and workflow, because trusted publishing is registered per package name and every alias's existing registration still names its archived standalone repository. Until an alias is registered, its publish leg fails with the exact one-time registration instructions in its annotation — a deliberate signal rather than a graceful skip, because a silent skip let every alias stay stranded from the monorepo migration until a manual audit found them; the failure still cannot block the release or the Pages deploy (nothing depends on the post-release jobs), it only makes the outstanding registration visible the moment a release runs. The legacy GitHub Packages mirror keeps its graceful skip (a legacy mirror package's Actions-access list still names only its archived standalone repository — grant this repository Write on the package's settings page once, and the next release mirrors automatically); the registration is: sign in to [npmjs.com](https://www.npmjs.com) as a user with access to the package's settings → **Packages** → the alias (e.g. `document-bytes`) → **Settings** → **Trusted publisher** → select **GitHub Actions**, then enter Organization `ExaDev`, Repository `documents.js`, Workflow filename `ci.yml` (filename only — it must exist in `.github/workflows/`), leave the environment empty, and allow the `npm publish` action ([npm's trusted-publishers documentation](https://docs.npmjs.com/trusted-publishers) has the canonical form). The first release after that publishes under the alias automatically. The stranded aliases are tracked individually in [ExaDev/documents.js#727](https://github.com/ExaDev/documents.js/issues/727), [#728](https://github.com/ExaDev/documents.js/issues/728), [#729](https://github.com/ExaDev/documents.js/issues/729), [#730](https://github.com/ExaDev/documents.js/issues/730), [#731](https://github.com/ExaDev/documents.js/issues/731), and [#770](https://github.com/ExaDev/documents.js/issues/770). +Every alias name's trusted publisher is registered against this repository and workflow (trusted publishing is registered per package name, so each alias needed its own one-time registration; all eleven landed 2026-09-10 and the backfill run [ExaDev/documents.js#34449796133](https://github.com/ExaDev/documents.js/actions/runs/34449796133) republished every alias at its package's then-current version — registry-confirmed). Until an alias is registered, its publish leg fails with the exact one-time registration instructions in its annotation — a deliberate signal rather than a graceful skip, because a silent skip let every alias stay stranded from the monorepo migration until a manual audit found them; the failure still cannot block the release or the Pages deploy (nothing depends on the post-release jobs), it only makes the outstanding registration visible the moment a release runs. The legacy GitHub Packages mirror keeps its graceful skip (a legacy mirror package's Actions-access list still names only its archived standalone repository — grant this repository Write on the package's settings page once, and the next release mirrors automatically); the registration is: sign in to [npmjs.com](https://www.npmjs.com) as a user with access to the package's settings → **Packages** → the alias (e.g. `document-bytes`) → **Settings** → **Trusted publisher** → select **GitHub Actions**, then enter Organization `ExaDev`, Repository `documents.js`, Workflow filename `ci.yml` (filename only — it must exist in `.github/workflows/`), leave the environment empty, and allow the `npm publish` action ([npm's trusted-publishers documentation](https://docs.npmjs.com/trusted-publishers) has the canonical form). The first release after that publishes under the alias automatically. The formerly stranded aliases' individual threads are [ExaDev/documents.js#727](https://github.com/ExaDev/documents.js/issues/727), [#728](https://github.com/ExaDev/documents.js/issues/728), [#729](https://github.com/ExaDev/documents.js/issues/729), [#730](https://github.com/ExaDev/documents.js/issues/730), [#731](https://github.com/ExaDev/documents.js/issues/731), and [#770](https://github.com/ExaDev/documents.js/issues/770), each carrying its registration evidence. `commitlint.config.ts` derives its allowed commit types from `release-workspace.config.ts`'s own `releaseRules`, preserving the invariant each package's own config was built around: a conventional-commit type cannot trigger a release without also being accepted by commit-message validation, or the reverse. diff --git a/packages/byte-codec/README.md b/packages/byte-codec/README.md index d5c572777..404012713 100644 --- a/packages/byte-codec/README.md +++ b/packages/byte-codec/README.md @@ -73,7 +73,7 @@ This package also published under an alternate name from the pre-monorepo pipeli - [document-bytes](https://www.npmjs.com/package/document-bytes) -**Frozen since the monorepo migration** — see the [root README's release note](../../README.md#releases): the alias republish step was dropped along with GitHub Packages mirroring and SBOM/provenance signing, and nothing today keeps this name in sync with `byte-codec`'s own releases. Tracked in [ExaDev/documents.js#727](https://github.com/ExaDev/documents.js/issues/727). +**Republished automatically** — the alias's trusted publisher is registered against this repository and workflow (2026-09-10), so every release from the [backfill run](https://github.com/ExaDev/documents.js/actions/runs/34449796133) onward publishes under this name too; the registration evidence is on [ExaDev/documents.js#727](https://github.com/ExaDev/documents.js/issues/727). ## License diff --git a/packages/document-schema.js/README.md b/packages/document-schema.js/README.md index efcd9bfd9..9b7e2a6b8 100644 --- a/packages/document-schema.js/README.md +++ b/packages/document-schema.js/README.md @@ -547,7 +547,7 @@ This package also published under the following alternate npm names from the pre - [document-schema](https://www.npmjs.com/package/document-schema) - [document-model.js](https://www.npmjs.com/package/document-model.js) -**Frozen since the monorepo migration** — see the [root README's release note](../../README.md#releases): the alias republish step was dropped along with GitHub Packages mirroring and SBOM/provenance signing, and nothing today keeps any of the five in sync with `document-schema.js`'s own releases. Tracked in [ExaDev/documents.js#730](https://github.com/ExaDev/documents.js/issues/730). +**Republished automatically** — the alias's trusted publisher is registered against this repository and workflow (2026-09-10), so every release from the [backfill run](https://github.com/ExaDev/documents.js/actions/runs/34449796133) onward publishes under this name too; the registration evidence is on [ExaDev/documents.js#730](https://github.com/ExaDev/documents.js/issues/730). ## License diff --git a/packages/documents.js/README.md b/packages/documents.js/README.md index 154b2b149..7a399d7f9 100644 --- a/packages/documents.js/README.md +++ b/packages/documents.js/README.md @@ -1015,7 +1015,7 @@ This package also published under an alternate name from the pre-monorepo pipeli - [js.documents](https://www.npmjs.com/package/js.documents) -**Frozen since the monorepo migration** — see the [root README's release note](../../README.md#releases): the alias republish step was dropped along with GitHub Packages mirroring and SBOM/provenance signing, and nothing today keeps this name in sync with `documents.js`'s own releases. Tracked in [ExaDev/documents.js#731](https://github.com/ExaDev/documents.js/issues/731). +**Republished automatically** — the alias's trusted publisher is registered against this repository and workflow (2026-09-10), so every `documents.js` release from [js.documents@7.17.4](https://github.com/ExaDev/documents.js/actions/runs/34449796133) onward publishes under this name too; the registration evidence is on [ExaDev/documents.js#731](https://github.com/ExaDev/documents.js/issues/731). ## License diff --git a/packages/markdown-codec/README.md b/packages/markdown-codec/README.md index 166274546..249cfc534 100644 --- a/packages/markdown-codec/README.md +++ b/packages/markdown-codec/README.md @@ -277,7 +277,7 @@ This package also published under an alternate name from the pre-monorepo pipeli - [mrkdwn.js](https://www.npmjs.com/package/mrkdwn.js) -**Frozen since the monorepo migration** — see the [root README's release note](../../README.md#releases): the alias republish step was dropped along with GitHub Packages mirroring and SBOM/provenance signing, and nothing today keeps this name in sync with `markdown-codec`'s own releases. Tracked in [ExaDev/documents.js#728](https://github.com/ExaDev/documents.js/issues/728). +**Republished automatically** — the alias's trusted publisher is registered against this repository and workflow (2026-09-10), so every release from the [backfill run](https://github.com/ExaDev/documents.js/actions/runs/34449796133) onward publishes under this name too; the registration evidence is on [ExaDev/documents.js#728](https://github.com/ExaDev/documents.js/issues/728). ## License diff --git a/packages/pdf-codec/README.md b/packages/pdf-codec/README.md index 154acbadd..870c0f144 100644 --- a/packages/pdf-codec/README.md +++ b/packages/pdf-codec/README.md @@ -359,7 +359,7 @@ This package also published under the following alternate npm names from the pre - [pdf-codec.js](https://www.npmjs.com/package/pdf-codec.js) - [pdf-parser.js](https://www.npmjs.com/package/pdf-parser.js) -**Frozen since the monorepo migration** — see the [root README's release note](../../README.md#releases): the alias republish step was dropped along with GitHub Packages mirroring and SBOM/provenance signing, and nothing today keeps either name in sync with `pdf-codec`'s own releases. Tracked in [ExaDev/documents.js#729](https://github.com/ExaDev/documents.js/issues/729). +**Republished automatically** — the alias's trusted publisher is registered against this repository and workflow (2026-09-10), so every release from the [backfill run](https://github.com/ExaDev/documents.js/actions/runs/34449796133) onward publishes under this name too; the registration evidence is on [ExaDev/documents.js#729](https://github.com/ExaDev/documents.js/issues/729). ## License