diff --git a/.github/badges/core-size.json b/.github/badges/core-size.json index f006be0..0cf6396 100644 --- a/.github/badges/core-size.json +++ b/.github/badges/core-size.json @@ -1,7 +1,7 @@ { "schemaVersion": 1, "label": "bundle size", - "message": "385 B gzip", - "color": "blueviolet", + "message": "383 B gzip", + "color": "brightgreen", "cacheSeconds": 3600 } diff --git a/packages/cli/package.json b/packages/cli/package.json index d48de2a..a865262 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "create-zero-ui", - "version": "2.0.4", + "version": "2.0.5", "description": "Zero-UI project scaffolder for React. Instantly sets up zero-runtime UI state, Tailwind variants, PostCSS, and SSR-safe config in Vite or Next.js apps.", "keywords": [ "react", @@ -49,7 +49,7 @@ "test": "node --test ../core/__tests__/unit/cli.test.cjs" }, "dependencies": { - "@react-zero-ui/core": "workspace:^0.4.3" + "@react-zero-ui/core": "workspace:^0.4.4" }, "engines": { "node": ">=22" diff --git a/packages/core/package.json b/packages/core/package.json index 4d4a5f3..5921981 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@react-zero-ui/core", - "version": "0.4.3", + "version": "0.4.4", "private": false, "scripts": { "build": "rm -rf dist && tsc -p tsconfig.build.json", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 84a66bb..d17083e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -103,7 +103,7 @@ importers: packages/cli: dependencies: '@react-zero-ui/core': - specifier: workspace:^0.4.3 + specifier: workspace:^0.4.4 version: link:../core packages/core: diff --git a/wiki/.wiki-system/audit-state.json b/wiki/.wiki-system/audit-state.json index c662317..b92f33e 100644 --- a/wiki/.wiki-system/audit-state.json +++ b/wiki/.wiki-system/audit-state.json @@ -2,13 +2,13 @@ "version": 1, "pages": { "pages/architecture.md": { - "fingerprint": "sha256:1f95acfe4821ff3d80418d45385ef3ef8ac402ea770b385a288b16f047258771" + "fingerprint": "sha256:27863bef93f7a6f73ea0834509d1bad9c425eeb3061c297d90a4212191ebebd4" }, "pages/build-test-ci.md": { - "fingerprint": "sha256:15d60098c3a7dfaf6c9ec3adccf435ac081b5254cb6458cd29d43cb0c314d6d9" + "fingerprint": "sha256:e0e832aa0eb7d6964298d7d37b6e0eca3ae700f12b4af9b7e437dc1943d1439e" }, "pages/core/experimental-runtime.md": { - "fingerprint": "sha256:8431b3cacc0517c70807c3d099040db1a219afd948668a885774a7832006fbca" + "fingerprint": "sha256:2fdfe64ad0dd18658ffc2efbeb9e138ff7982b60f7d232b7c844ad91aa50432b" }, "pages/core/runtime-hooks.md": { "fingerprint": "sha256:85f8659cfb30965e31dee7e826f125e3731d735df4f68b01d6707c9dd50a17c3" @@ -23,10 +23,10 @@ "fingerprint": "sha256:427d27f3996c4418070af852ac243ba4921aa36eecead0308abdb126534367b4" }, "pages/operations.md": { - "fingerprint": "sha256:cbb8f2457d0ed70b08ac741521f35bf5ed680930627e5b2b4dba9b1846190cea" + "fingerprint": "sha256:a8f10d30b35e3acf4a26670a61305bb535a15a72e6620b8b7b185dbd8e6f2d02" }, "pages/packages-publishing.md": { - "fingerprint": "sha256:4fdc75615b3297f05a9aedb32fe6bbb25c804ae7cbcb9c26dcf44480547043e4" + "fingerprint": "sha256:cf1c2f75e2f1b41af4afef00b538e5390123fe26fe063f0ee90a832a58e3d09d" } } } diff --git a/wiki/pages/packages-publishing.md b/wiki/pages/packages-publishing.md index e169dda..ba281ae 100644 --- a/wiki/pages/packages-publishing.md +++ b/wiki/pages/packages-publishing.md @@ -34,13 +34,15 @@ Publishing a GitHub Release triggers npm publication through [oss-release-truste | `@react-zero-ui/core` | [.oss-release.yaml](../../.oss-release.yaml) (default) | `core-v` | GitHub Release, npm | | `create-zero-ui` | [.oss-release.cli.yaml](../../.oss-release.cli.yaml) | `cli-v` | npm | -Update the package version, commit/push it to `main`, then publish a GitHub Release with the matching tag. For example, core version `0.4.4` uses `core-v0.4.4`; installer version `2.0.5` uses `cli-v2.0.5`. A draft release does not publish npm. The tagged commit must already contain the matching package version and workflow. +Update the package version through a pull request, merge it to `main`, then publish a GitHub Release with the matching tag. For example, core version `0.4.4` uses `core-v0.4.4`; installer version `2.0.5` uses `cli-v2.0.5`. A draft release does not publish npm. The tagged commit must already contain the matching package version and workflow. + +GitHub protects `main` with a pull request, an approving review, linear history, and the `Test Suite` and `Vercel` checks. Recheck current rules before merging. Admin credentials may bypass these rules even for an ordinary push; do not use a direct push as the release merge step. Before real publication, local `main` must match the merged `origin/main` commit, because the shared orchestrator starts by pushing the configured branch. The workflow resolves the package from the tag, checks its manifest version, installs locked dependencies with the manifest's pnpm version on Node 24, prepares packed fixtures, runs `pnpm test`, and validates the selected tarball before publishing with npm OIDC. Node 24 is the release runner; package consumers still require Node >=22. The obsolete disabled release-please workflow was removed. Release and manual-dispatch runs for the same tag are serialized. If npm already contains that version, the later run succeeds without publishing again; registry errors other than a missing version stop the run. This accommodates the shared CLI creating a GitHub Release and also dispatching the workflow. Prerelease versions or GitHub prereleases publish under npm's `next` tag; stable releases use `latest`. Promoting an existing npm version's dist-tag is a separate operation. -For a release, update the selected package's version and any affected lockfile entries first. When shipping a CLI update that requires a newer core, update its `workspace:^...` minimum too; release core before that CLI. Inspect `pnpm release:pack` output, run checks, and commit the changes on `main` before the release dry run. Never republish an existing npm version. +For a release, update the selected package's version and any affected lockfile entries first. When shipping a CLI update that requires a newer core, update its `workspace:^...` minimum too; release core before that CLI. Inspect `pnpm release:pack` output, run checks, and merge the changes through the protected branch before publication. The orchestrator's dry run requires a clean checkout on the configured `main` branch; repeat it after merging if release inputs changed. Never republish an existing npm version. The shared `_oss-release` skill remains available for agent-driven checks, tags, GitHub Releases, dispatch, and registry verification. Its CLI config publishes the installer directly with its own tag, allowing both packages to release from one commit without the shared tool's "no new commits" GitHub Release restriction. The GitHub UI can also publish installer releases directly.