ci(release): stage packages on npm for maintainer approval

[sthanikan2000]

The rest of the release work, #102 (PR checks, labels, the release-package skill, workflow hardening), is stacked on top of this PR.

Summary

Make the npm release a two-key operation. release.yml now stages the package with npm stage publish instead of publishing it; the version is not installable until a maintainer approves it on npm with 2FA. With each package's trusted publisher limited to npm stage publish, the release workflow can't make a version live by itself, even if the workflow, a third-party action in it, or a GitHub session is compromised. The enforcement is on npm's side, outside the repo.

It doesn't replace PR review, and npm doesn't document whether the person who staged a version can also approve it, so a different approver is a convention only.

Type of change

• Bug fix
• New feature
• Improvement to an existing feature
• Breaking change (consumers must change their code)
• Docs, tests, refactor or CI only

Changes made

• release.yml: npm publish → npm stage publish (the dry run too). Asserts npm ≥ 11.15.0, which npm stage needs. Writes the command output and the approve commands to the job summary, since the approver needs the stage ID. Exposes the package version as a step output for that summary.
• version-bump.yml and the README: describe the extra "approve on npm" step.
• New CONTRIBUTING.md, with only the staging docs: Approving a staged release (list, download, approve, reject; inspect the tarball first) and npm settings for a package.

Testing

• actionlint and prettier --check are clean (the one actionlint style notice left in version-bump.yml is on main already)
• Not run end to end. It needs a real tag and npm's staging queue, so the first release after this is the test. What to check on that release:
  • the "Stage on npm" step prints a stage ID, and the job summary shows it
  • after approval, the version is on npm (npm view) and carries its provenance badge. The npm docs list --provenance for npm stage publish but don't say when the attestation is attached, so this is the main unknown
  • what a re-run does while a version is staged, and whether npm view shows a staged version (neither is documented)

Release notes

N/A. No package changes (skip-changelog).

Rollout order (npm settings, outside this diff)

1. Merge this PR first. npm stage publish is always allowed for a trusted publisher, so it works with the current configuration.
2. Then, on npmjs.com for @opennsw/jsonforms-renderers: Trusted Publisher → Allowed actions → turn off npm publish, keep npm stage publish. Doing it before the merge would break the next release, because main still calls npm publish.
3. Under the package's publishing access, require two-factor authentication and disallow tokens, otherwise a legacy token could still publish directly.
4. For @opennsw/auth, register the trusted publisher (repo OpenNSW/ui-packages, workflow release.yml) with npm stage publish only from the start.

Docs used: staged publishing, npm stage, trusted publishing.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 14994f0e-df21-429c-a7fd-9ae4b739930e

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[ginaxu1]

Lgtm