From 4bab09a48410f08e186918fbc6ce0709277bc781 Mon Sep 17 00:00:00 2001 From: willbot Date: Mon, 13 Jul 2026 08:15:53 +0200 Subject: [PATCH] docs(versioning): bootstrap section reflects the two-package surface The one-time trusted-publishing bootstrap was written for the nine-package family and the prisma/app repo name; it completed 2026-07-12 for the two 9-public packages. Reworded to the current surface and kept as the procedure for future @prisma/compose- packages. Co-Authored-By: Claude Opus 4.8 Signed-off-by: willbot Signed-off-by: Will Madden --- docs/oss/versioning.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/docs/oss/versioning.md b/docs/oss/versioning.md index af72a582..9c875e42 100644 --- a/docs/oss/versioning.md +++ b/docs/oss/versioning.md @@ -118,15 +118,18 @@ cannot publish the initial version of a package via OIDC** — the package must exist before you can enable a trusted publisher (unlike PyPI). So the first release is a one-time manual bootstrap; every release after that goes through the workflow: -1. **Create the packages once, with a token.** On a machine logged in to npm as a user - with publish rights to the `@prisma` scope (and the ability to create the unscoped - `prisma-compose`): `pnpm install && pnpm build`, then - `node scripts/publish-packages.mjs --tag latest`. This publishes all nine packages at - the current root version with correct exact-pinned deps. -2. **Configure a trusted publisher on each of the nine packages** at +_Completed 2026-07-12 for both packages; kept as the procedure for any future +package (e.g. a new `@prisma/compose-`)._ + +1. **Create the package once, with a token.** On a machine logged in to npm as a + user with publish rights to the `@prisma` scope: `pnpm install && pnpm build`, + then `node scripts/publish-packages.mjs --tag latest`. This publishes the + publishable packages (the two in `packages/9-public/`) at the current root + version with correct exact-pinned deps. +2. **Configure a trusted publisher on each published package** at `npmjs.com/package//access` → *Trusted Publisher* → GitHub Actions: - Organization or user: `prisma` - - Repository: `app` + - Repository: `compose` - Workflow filename: `publish.yml` - Environment: leave blank - Allowed action: **npm publish**