From 67ec983cb38f832bfe6245de9c961b01d23d0c92 Mon Sep 17 00:00:00 2001 From: Sutu Sebastian Date: Mon, 6 Jul 2026 14:26:33 +0300 Subject: [PATCH] =?UTF-8?q?docs:=20close=20npm-provenance=20verification?= =?UTF-8?q?=20=E2=80=94=20strike=20roadmap=20bullet;=20note=20provenance?= =?UTF-8?q?=20in=20CONTRIBUTING?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 0.2.0 published with SLSA provenance v1 + Sigstore signatures via npm trusted publishing (OIDC) — verified (`npm view …@0.2.0` shows `dist.attestations.provenance`). The `roadmap.md` "npm provenance — verify on next release" bullet is complete (NPM_TOKEN repo secret also deleted), so strike it. The durable "trusted publishing + provenance" fact already lives in CONTRIBUTING.md § Releases; append "Sigstore provenance is auto-generated" there rather than duplicating into architecture.md § Publishing (which covers the package surface, not the release workflow). --- .github/CONTRIBUTING.md | 2 +- docs/roadmap.md | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index ff567d0..3bec672 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -46,7 +46,7 @@ Match Oxfmt/Oxlint; prefer **straight-line code** and extracted helpers over lon ### Releases -[@changesets/cli](https://github.com/changesets/changesets) — run **`bunx changeset`** when your PR should bump the version, and commit the `.changeset/*.md` file. The Release workflow opens a "Version packages" PR and publishes to npm on merge via trusted publishing (GitHub OIDC; no `NPM_TOKEN`). +[@changesets/cli](https://github.com/changesets/changesets) — run **`bunx changeset`** when your PR should bump the version, and commit the `.changeset/*.md` file. The Release workflow opens a "Version packages" PR and publishes to npm on merge via trusted publishing (GitHub OIDC; no `NPM_TOKEN`); Sigstore provenance is auto-generated. ### Issues diff --git a/docs/roadmap.md b/docs/roadmap.md index 4f58d48..7c5f5db 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -7,7 +7,6 @@ Forward-looking plans only — **not** a mirror of `src/`. **Doc index:** [READM ## Next - **Remaining ROI work** — actionable items not yet shipped: TanStack Query bridge, `examples/` workspace, docs site, real-browser + SSR + framework-runtime test matrix, React ergonomics layer, OPFS/SQLite/Cloudflare adapters, playground. Plan: [`plans/remaining-roi.md`](./plans/remaining-roi.md). -- **npm provenance — verify on next release** — trusted publishing + `publishConfig.provenance: true` shipped (`.github/workflows/release.yml`). On the next changeset merge to `main`, confirm the npm version page shows the Provenance badge (or `npm view @stainless-code/persist@ --json` includes `dist.attestations`), then revoke + delete the legacy `NPM_TOKEN` repo secret. - **Upstream TanStack Persist collaboration** — pitch the `persistSource` middleware model (structural `PersistableSource` + first-class hydration lifecycle) to the TanStack Persist maintainers as a merge target, after the stainless-code publish stabilises. Draft: [`plans/upstream-tanstack-pitch.md`](./plans/upstream-tanstack-pitch.md). ---