REL-001 — Complete npm bootstrap and Trusted Publishing activation

[dDevAhmed]

Summary

Complete the one-time administrative setup required to publish @diginodes/stellarforge-cli@0.1.0 through the protected OIDC workflow.

The original @stellarforge npm scope was unavailable. The permanent package identity is therefore @diginodes/stellarforge-cli, owned by the diginodes npm organization and aligned with the DigiNodes GitHub organization.

One-time npm namespace bootstrap

Use the reviewed bootstrap branch:

release/npm-bootstrap-0.0.0

Validated branch head:

8c2cf209eef97349a46cfb1dfb2002834c8e29b6

From an approved maintainer workstation:

git clone https://github.com/DigiNodes/stellarforge-cli.git stellarforge-cli-bootstrap
cd stellarforge-cli-bootstrap
git checkout 8c2cf209eef97349a46cfb1dfb2002834c8e29b6
npm ci --ignore-scripts --no-audit --no-fund
npm run build
npm run release:dry-run
npm login --auth-type=web --registry=https://registry.npmjs.org/
npm publish --access public --tag bootstrap

The bootstrap must create @diginodes/stellarforge-cli@0.0.0 under the non-default bootstrap dist-tag. npm also assigns latest to a package's first published version and currently rejects removing it with HTTP 400; the first OIDC release must move latest to 0.1.0.

Do not add an NPM_TOKEN to GitHub.

npm Trusted Publisher

After the package exists, configure:

• package: @diginodes/stellarforge-cli
• provider: GitHub Actions
• organization/user: DigiNodes
• repository: stellarforge-cli
• workflow: release.yml
• environment: npm-release
• direct npm publish: allowed

GitHub administrative controls

• create environment npm-release;
• require maintainer approval;
• restrict deployment to main;
• create repository Actions variable NPM_PUBLISH_ENABLED=false;
• change it to true only after bootstrap, Trusted Publishing, environment protection, and release-readiness changes are verified;
• keep Dependency Graph enabled so Dependency Review remains enforceable.

Activate 0.1.0 publication

After all controls are in place:

1. merge the reviewed release-readiness change;
2. verify the Release workflow enters publish mode;
3. approve the npm-release environment;
4. verify npm publishes @diginodes/stellarforge-cli@0.1.0;
5. verify the matching Git tag and GitHub Release exist;
6. verify npm provenance is displayed;
7. verify npm view @diginodes/stellarforge-cli version reports 0.1.0.

Acceptance Criteria

• bootstrap 0.0.0 exists under the bootstrap tag (npm temporarily also assigns latest to the first version);
• npm Trusted Publisher is configured;
• GitHub npm-release environment is protected;
• NPM_PUBLISH_ENABLED=true is configured only after verification;
• Dependency Graph is enabled and Dependency Review executes successfully;
• 0.1.0 publishes through OIDC without a long-lived npm token;
• npm package, Git tag, GitHub Release, and provenance agree on 0.1.0.

Security

Do not paste npm credentials, 2FA codes, private tokens, CLI authorization URLs, or secret material into this issue or CI logs.

[dDevAhmed]

Progress update (2026-09-16): GitHub Dependency Graph/Dependency Review is now operational. Recent PRs #92 and #93 received successful Dependency Review runs, so the Dependency Graph acceptance item is effectively satisfied. Remaining REL-001 work is the maintainer-controlled npm namespace bootstrap, npm Trusted Publisher configuration, protected npm-release environment, NPM_PUBLISH_ENABLED=true, and first protected OIDC publication/provenance verification.

[dDevAhmed]

Repository-side REL-001 readiness is complete as of merge commit 224c484b411e71791fba474fbf103f11a874170d.

Verified post-merge Release run: https://github.com/DigiNodes/stellarforge-cli/actions/runs/35670800591

• Release workflow completed successfully.
• 31 test files / 155 tests passed.
• Release artifacts were validated and packed.
• Publication disabled completed successfully.
• Publish npm package and GitHub release was skipped.
• NPM_PUBLISH_ENABLED remains false.
• No 0.1.0 product release was performed.

The protected OIDC release path is now prepared but intentionally dormant until the CLI reaches an approved release milestone. The remaining REL-001 acceptance criteria should stay open until maintainers intentionally authorize and verify the first real release.

[dDevAhmed]

Contributor-readiness follow-up is in PR #224.

Audit results:

• exactly 16 dependency-free Wave issues are currently labeled intake: ready, matching the configured first batch;
• clean Node/npm setup succeeds;
• the prior Node-only npm test failure was caused by unconditional local Cargo execution; PR chore: complete contributor readiness follow-up #224 preserves template assertions everywhere and runs cargo metadata only when Cargo is installed;
• release/onboarding docs now distinguish the npm 0.0.0 bootstrap placeholder from a supported release and record the completed Trusted Publisher/environment/Dependency Graph setup;
• NPM_PUBLISH_ENABLED remains false.

Local validation: typecheck, lint, formatting, 155 applicable tests, build, and package dry-run all pass. GitHub CI, Dependency Review, Contributor PR Guard, E2E Smoke, and CodeQL are green on PR #224. REL-001 remains open for the first approved protected OIDC publication.