ci(release): prepare public design package publishing

Author: altaywtf

.github/workflows/deploy.yml

@@ -45,6 +45,8 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0

.github/workflows/publish-package.yml

@@ -0,0 +1,73 @@
+name: Publish Package
+
+on:
+  workflow_dispatch:
+    inputs:
+      dist_tag:
+        description: npm dist-tag
+        required: true
+        default: next
+        type: choice
+        options:
+          - next
+          - latest
+
+concurrency:
+  group: putio-design-publish-package
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    environment:
+      name: release
+      url: https://www.npmjs.com/package/@putdotio/design
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
+        with:
+          node-version-file: .node-version
+          registry-url: https://registry.npmjs.org
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        with:
+          cache: false
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Verify package and design system
+        run: pnpm verify:full
+
+      - name: Validate package version
+        env:
+          PACKAGE_NAME: "@putdotio/design"
+        run: |
+          set -euo pipefail
+          package_version="$(node -p "JSON.parse(fs.readFileSync('package.json', 'utf8')).version")"
+          if [ "$package_version" = "0.0.0" ] || [ "$package_version" = "0.0.0-development" ]; then
+            echo "Refusing to publish placeholder version $package_version"
+            exit 1
+          fi
+          if npm view "$PACKAGE_NAME@$package_version" version >/dev/null 2>&1; then
+            echo "$PACKAGE_NAME@$package_version is already published"
+            exit 1
+          fi
+          echo "Publishing $PACKAGE_NAME@$package_version with dist-tag ${{ inputs.dist_tag }}"
+
+      - name: Publish to npm
+        run: npm publish --provenance --access public --tag "${{ inputs.dist_tag }}"

.github/workflows/verify.yml

@@ -6,7 +6,7 @@ on:
     branches:
       - main
     paths:
-      - ".github/workflows/verify.yml"
+      - ".github/workflows/**"
       - ".htmlvalidate.json"
       - ".node-version"
       - "DESIGN.md"
@@ -36,6 +36,8 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0

README.md

@@ -20,6 +20,10 @@ This repo owns the public contract behind it: DTCG token sources, generated CSS/
 
 Token sources live in [`tokens`](tokens). Generated package artifacts live in [`dist`](dist).
 
+```bash
+npm install @putdotio/design
+```
+
 Common entrypoints:
 
 - CSS custom properties: [`dist/css/tokens.css`](dist/css/tokens.css)

docs/DISTRIBUTION.md

@@ -1,7 +1,7 @@
 # Distribution
 
 `putio-design` ships two public surfaces: the static design guide at
-`design.put.io` and optional package artifacts from `@putdotio/design`.
+`design.put.io` and package artifacts from `@putdotio/design`.
 
 ## Static Site
 
@@ -16,9 +16,8 @@ The deploy workflow must run `pnpm verify` before publishing the site.
 
 ## Package Artifacts
 
-The package stays private until an explicit publishing decision is made. Its
-exports are prepared so a future public npm release can expose the same generic
-surfaces without redesigning the repo:
+`@putdotio/design` is a public scoped npm package. It exposes generic token
+artifacts and the design contract only:
 
 - `@putdotio/design/css`
 - `@putdotio/design/tokens`
@@ -31,6 +30,19 @@ Do not publish platform-native outputs from this repo in v1. Web, iOS, Android,
 Roku, and TV repos should consume the generic token artifacts and own their
 platform adapters.
 
+Package publishing uses the manual `Publish Package` GitHub Actions workflow.
+The workflow runs `pnpm verify:full`, publishes with npm provenance, and expects
+npm Trusted Publishing to be configured for the `release` GitHub Environment.
+Use the `next` dist-tag for pre-release or adoption-test packages, and `latest`
+only for a release that should become the default npm install target.
+
+Before the first publish, an npm maintainer must trust this workflow for the
+package:
+
+```bash
+npx -y npm@^11.10.0 trust github @putdotio/design --repo putdotio/putio-design --file publish-package.yml --env release --allow-publish --yes
+```
+
 ## Generated Files
 
 Token sources live in `tokens/**/*.tokens.json`. Generated files are checked in

package.json

@@ -1,9 +1,26 @@
 {
   "name": "@putdotio/design",
-  "version": "0.0.0",
-  "private": true,
+  "version": "0.1.0-alpha.0",
+  "description": "Public put.io design tokens, generated token artifacts, and design-system guidance.",
   "license": "MIT",
   "type": "module",
+  "homepage": "https://design.put.io",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/putdotio/putio-design.git"
+  },
+  "bugs": {
+    "url": "https://github.com/putdotio/putio-design/issues"
+  },
+  "keywords": [
+    "putio",
+    "design-system",
+    "design-tokens",
+    "dtcg"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
   "files": [
     "DESIGN.md",
     "dist",