Ship released CLI to npm (first publish)

[lukaso]

The CLI is built (packages/cli/dist/cli.js exists) but has never been published. As a result the "CLI" link in nav + footer (https://www.npmjs.com/package/released) 404s, and npx released ... (advertised in README.md) does not work.

Blockers:

• packages/cli/package.json is "private": true and version: "0.0.0"
• packages/core/package.json is "private": true and version: "0.0.0" — and the CLI's dist/cli.js imports @released/core as an external (not bundled), so core has to be published too
• No changeset exists, so the Changesets release workflow won't publish anything

Plan:

1. Remove "private": true from both packages/cli/package.json and packages/core/package.json
2. Update packages/core/package.json description (drop the stale "not separately published in v1" line)
3. Add a changeset (pnpm changeset) — both packages bump together because of the linked config in .changeset/config.json. Likely 0.1.0 minor since this is the first public release.
4. Merge the Changesets-generated "Version Packages" PR → workflow auto-publishes via npm Trusted Publishing (OIDC) per .github/workflows/release.yml
5. Confirm npm view released returns a real entry and npx released github.com/facebook/react/commit/<sha> works end-to-end

Verification:

• After publish, the existing nav/footer links to npmjs.com/package/released resolve.
• README's npx example works without a workspace clone.

[lukaso]

Shipped — git-released@0.1.2 is live on npm with OIDC provenance.

Diverged from the original plan in three ways:

1. Renamed CLI to git-released. The unscoped released name was claimed in 2014 by an unrelated package. git-released was already a bin alias, so git released <sha>, npx git-released ..., and released ... all work after install.

2. @released/core is bundled into the CLI, not published separately. The @released/core npm scope is squatted by another org (publishes 403'd). Rather than pivot scopes, core is now bundled into the CLI tarball at build time (tsup, via devDependency) — matching its original "internal workspace package" intent. Tarball: 3 files, 15.4 kB, self-contained (cac + micromark are the only runtime deps).

3. Version history is 0.1.1 → 0.1.2, not a clean 0.1.0. The first publish (0.1.0) shipped from a stale branch with an unresolvable @released/core runtime dep — deprecated on the registry. 0.1.1 was the first working release (manual publish to claim the name + bootstrap Trusted Publishing). 0.1.2 validated the full CI OIDC path end-to-end.

Release infrastructure now in place:

• npm Trusted Publishing (OIDC) — no NPM_TOKEN, short-lived token exchanged at publish time + signed provenance attestation
• Node 24 / npm 11.x on the release runner; repository field on package.json
• Changesets flow documented in README ("Releasing the CLI" + bump-type guidance)
• CLI verified against GitHub (honojs/hono) and GitLab (gnachman/iterm2, authenticated) lookups

Future releases: pnpm changeset → push → merge the auto-PR → CI publishes via OIDC. No manual npm publish.