Skip to content

docs: add release-readiness baseline - #7

Closed
bntvllnt wants to merge 1 commit into
mainfrom
docs/release-readiness-baseline
Closed

docs: add release-readiness baseline#7
bntvllnt wants to merge 1 commit into
mainfrom
docs/release-readiness-baseline

Conversation

@bntvllnt

Copy link
Copy Markdown
Collaborator

Summary

  • Add minimal release-readiness docs for @vllnt/typescript: CHANGELOG.md, CONTRIBUTING.md, SECURITY.md, AGENTS.md, llms.txt, and llms-full.txt
  • Document the current public TypeScript preset package, contribution/security expectations, and no-release agent guardrails
  • No version bump, tag, publish, merge, or announcement action taken

Verification

  • npm test (3 tests passed)
  • npm pack --dry-run
  • git diff --check HEAD~1..HEAD

Review gate

{"branch":"vllnt-oss","tenant":"releases","aor_fit":true,"context_read":true,"evidence_attached":true,"opsec_checked":true,"safe_for_next_step":true,"blocking_findings":[]}

@greptile-apps greptile-apps Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

@bntvllnt bntvllnt left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review — 0 findings (0 blocking, 0 warn)

BLOCKING

None.

WARN

None.

VERIFIED CLEAN

  • Full changed-file coverage: AGENTS.md, CHANGELOG.md, CONTRIBUTING.md, SECURITY.md, llms.txt, and llms-full.txt.
  • The added release-readiness docs stay inside the package's public docs/policy surface and do not change package code, presets, package metadata, tags, release workflow behavior, or npm publishing state.
  • Public package facts in the new docs match the current repo/package evidence: @vllnt/typescript is MIT, Node.js >=22, npm version 1.0.0, tag v1.0.0 exists, and the CI/smoke-test backfill happened after that tag.
  • No private VLLNT operational details, credentials, customer data, local paths, or unsupported customer/support commitments were introduced.
  • Security wording is appropriately scoped for a TypeScript config package and does not promise a fixed SLA.
  • Release actions remain intentionally human-controlled: no version bump, tag, npm publish, merge, or release action was taken.

VALIDATION

  • Reviewed exact head: aa2d97937471f3804c3cdd4ddea1c2754f1f20c8.
  • GitHub checks at review time: Validate SUCCESS; CodeQL / Analyze (actions) / Analyze (javascript-typescript) SUCCESS.
  • Local validation: npm test passed (3/3 smoke tests); npm pack --dry-run passed and confirmed the published tarball surface remains the five preset JSON files plus README.md, LICENSE, and package.json.
  • Viewed-state coverage: all six changed files were marked viewed.

Approval is recommended, but final approval is reserved for bntvllnt.

@bntvllnt

Copy link
Copy Markdown
Collaborator Author

Superseded by #9, which includes this documentation baseline together with the complete TypeScript 7 upgrade and release gates.

@bntvllnt bntvllnt closed this Aug 31, 2026
bntvllnt added a commit that referenced this pull request Aug 31, 2026
## Summary

- prepare `@vllnt/typescript@2.0.0` for the stable TypeScript 7.0.2
compiler while retaining the official TypeScript 6 compatibility API for
tools such as `typescript-eslint`
- make TypeScript 7 defaults explicit (`types: []`, stable ordering,
side-effect import checks, no lib replacement) and document the breaking
v1-to-v2 migration
- replace JSON-only smoke tests with TypeScript 6/7 compiler fixtures,
declaration/runtime checks, installed-tarball validation, and real
React/Vite and Next.js builds
- standardize the repository on pnpm, Vitest coverage, Prettier, ESLint,
a deterministic lockfile, exact package exports, and complete public
docs
- harden CI and npm OIDC publishing with SHA-pinned actions, immutable
artifact verification, main-only reviewed stable releases, provenance,
and retry-safe tag/package reconciliation

## 2.0.0 canary behavior

`package.json` is intentionally set to `2.0.0`. After this PR merges to
`main`, the push workflow publishes:

```text
2.0.0-canary.<short-sha>
```

under the npm `canary` dist-tag. It does **not** move `latest`. Stable
`2.0.0` remains a separate, manually reviewed environment deployment
from the already-versioned `main` commit.

## Breaking changes

- TypeScript 5 is no longer supported; the peer range is `>=6.0.2 <8`.
- Ambient type packages are opt-in and must be listed in each consumer's
`types` array.
- Emitting projects must set `rootDir` explicitly.
- Consumers using JavaScript-API tooling should follow the documented
TypeScript 6/7 side-by-side installation.

## Verification

- `pnpm check`
  - formatting and linting pass
  - 11 compiler/package tests pass
  - 100% statements, branches, functions, and lines for test helpers
  - React 19.2.8 / Vite 8.2.2 build passes
  - Next.js 16.3.3 native TypeScript 7 build passes
- `pnpm audit --audit-level high` — no known vulnerabilities
- `pnpm pack --dry-run --json` — exact 11-file public package surface
- TypeScript 7.0.2 and TypeScript 6 compatibility compiler both
validated
- independent release-gate re-review — no blockers found

## Repository settings

The `npm` GitHub environment now requires maintainer review and
restricts deployments to protected branches. No package, stable release,
tag, or merge was created by this PR update.

Closes #2
Closes #3
Closes #4
Closes #5
Closes #6
Supersedes #7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant