EmryZhang opened a new pull request, #338: URL: https://github.com/apache/casbin-casbin.js/pull/338
Keep RC tag pushes limited to unsigned GitHub prereleases without npm or latest promotion. Final publication uses manual dispatch with separate project/IPMC result links, checks the committed package identity and version, downloads the official ASF source/checksum/signature, verifies it against KEYS and the selected tag, and builds npm from that extracted source. Refuse replacement of existing GitHub releases and include the incubation disclaimer in generated notes. Freeze dependency installation, disable install scripts and validate the actual npm contents before exposing the npm token to publication. Stable tags no longer trigger an automatic final publication. Validation: 18 release-helper safety fixtures and actionlint pass; the combined source's lint, 45 tests on each of Node 20/22/24, build, real npm packaging/installation and browser bundle build pass. Signature/network paths in the fixtures are mocked; actual votes, signing, staging, registry administration and publication remain later RM responsibilities. Depends on adoption of the 1.3.0 `apache-casbin.js` metadata PR before use. An interrupted partial publication deliberately stops for reconciliation rather than overwriting assets or an npm version. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
