Maintainer Information

Releasing

Releases run through the Release GitHub Actions workflow. There is no local release script.

1. Go to Actions > Release > Run workflow and enter the version, for example 0.2.0.
2. The workflow validates the version (plain X.Y.Z, tag must not exist yet), runs the full quality gate (lint, format check, typecheck, tests, build), bumps package.json and package-lock.json, prepends auto-generated release notes to CHANGELOG.md, commits, tags v<version>, creates the GitHub release, and publishes @eclipsesource/review-guard-mcp to npm.

Publishing uses npm trusted publishing with OIDC. No npm token is stored in the repository and provenance attestations are attached automatically.

One-time setup

1. The very first publish must be manual, because the package has to exist on npmjs.com before a trusted publisher can be configured:

   npm login          # an account with publish rights in the @eclipsesource org
   npm publish        # prepack builds dist/ automatically

2. On npmjs.com, open the package settings, choose Trusted Publisher, and configure GitHub Actions with organization eclipsesource, repository review-guard, and workflow filename release.yml.

3. If main is branch-protected, allow the github-actions bot to push the release commit, or add the workflow to the bypass list.

4. Once the repository is public, enable Settings > Code security > Private vulnerability reporting so the reporting flow described in SECURITY.md is available.

Troubleshooting

• A 404 from npm publish usually means the trusted publisher configuration does not match the workflow. Check that organization, repository, and workflow filename are exact.
• The workflow refuses versions whose tag already exists. Pick the next version instead of reusing one.