v0.5.0

release: mint 0.4.15 → 0.5.0 (deno.json support) (#15)

mint version output — consumes the deno-json-support + consumer-dependency-age-docs
intents, bumps jsr.json + package.json in lockstep (the new multi-manifest
behavior, dogfooded), prepends CHANGELOG.md. After merge: mint release cuts v0.5.0
→ release.yml publishes (npm/JSR, gated).

Claude-Session: https://claude.ai/code/session_01V6j1N17T8exXeF8S6r99EM

Co-authored-by: Robert Delanghe oink_monocle_7d@icloud.com
Co-authored-by: Claude Opus 4.8 noreply@anthropic.com

v0.4.15

fix(pkg): add repository field + record trusted publisher config

npm provenance verification requires package.json "repository.url" to
match the GitHub repo URL from the OIDC claims. Also commits the trusted
publisher schema so the config is documented in the repo.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.14

fix(ci): revert _authToken strip — empty token IS the OIDC trigger

Stripping the _authToken line from .npmrc causes ENEEDAUTH because npm
needs the empty ${NODE_AUTH_TOKEN} reference to detect "no static token
present" and fall through to the OIDC trusted-publishing exchange.
The real fix was the trusted publisher config (no env restriction, Publish
action checked).

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.13

fix(ci): strip injected _authToken so npm OIDC exchange fires

actions/setup-node writes an empty _authToken to NPM_CONFIG_USERCONFIG;
npm sees it and skips the OIDC trusted-publishing exchange. Strip the line
before publishing so npm falls through to request + exchange the GitHub
Actions OIDC token.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.12

fix(ci): remove registry-url from npm job to fix OIDC auth

actions/setup-node with registry-url injects NODE_AUTH_TOKEN into .npmrc,
which conflicts with the OIDC token exchange npm trusted publishing uses.
Removing registry-url lets npm handle auth entirely via OIDC.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.11

feat(ci): separate approve gate from deploy jobs

Split the publish job into approve (environment gate, no-op) + npm + jsr
as independent parallel jobs. One approval unblocks all deploys; each
target has its own log and can be retried independently. Add new deploy
targets with needs: [release, approve].

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.10

feat(ci): single publish job gates npm + JSR behind one approval

Consolidate jsr + npm-approve into a single publish job. The npm-publish
environment required-reviewer blocks all deploys — one click approves
both registries. Future deploy targets go in the same job.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.9

feat(ci): gate npm publish behind GitHub Environment approval

Replace npm staged publishing (OIDC support incomplete) with npm publish
gated by the npm-publish environment required-reviewer. A maintainer
approves in the Actions UI → npm publish runs immediately via OIDC
trusted publishing. Same human gate, simpler flow.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.8

fix(ci): move npm stage publish into environment-scoped job

The OIDC token for npm trusted publishing must carry the environment
claim. Running npm stage publish in a job without environment: npm-publish
produced E401 even with the trusted publisher configured. Moving it into
the npm-approve job (which declares the environment) fixes the claim.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.7

chore: trigger release to exercise fixed trusted publisher config

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com