docs: add release-readiness baseline - #7
Closed
bntvllnt wants to merge 1 commit into
Closed
Conversation
There was a problem hiding this comment.
Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.
bntvllnt
commented
May 18, 2026
bntvllnt
left a comment
Collaborator
Author
There was a problem hiding this comment.
Review — 0 findings (0 blocking, 0 warn)
BLOCKING
None.
WARN
None.
VERIFIED CLEAN
- Full changed-file coverage:
AGENTS.md,CHANGELOG.md,CONTRIBUTING.md,SECURITY.md,llms.txt, andllms-full.txt. - The added release-readiness docs stay inside the package's public docs/policy surface and do not change package code, presets, package metadata, tags, release workflow behavior, or npm publishing state.
- Public package facts in the new docs match the current repo/package evidence:
@vllnt/typescriptis MIT, Node.js>=22, npm version1.0.0, tagv1.0.0exists, and the CI/smoke-test backfill happened after that tag. - No private VLLNT operational details, credentials, customer data, local paths, or unsupported customer/support commitments were introduced.
- Security wording is appropriately scoped for a TypeScript config package and does not promise a fixed SLA.
- Release actions remain intentionally human-controlled: no version bump, tag, npm publish, merge, or release action was taken.
VALIDATION
- Reviewed exact head:
aa2d97937471f3804c3cdd4ddea1c2754f1f20c8. - GitHub checks at review time:
ValidateSUCCESS;CodeQL/Analyze (actions)/Analyze (javascript-typescript)SUCCESS. - Local validation:
npm testpassed (3/3 smoke tests);npm pack --dry-runpassed and confirmed the published tarball surface remains the five preset JSON files plusREADME.md,LICENSE, andpackage.json. - Viewed-state coverage: all six changed files were marked viewed.
Approval is recommended, but final approval is reserved for bntvllnt.
Collaborator
Author
|
Superseded by #9, which includes this documentation baseline together with the complete TypeScript 7 upgrade and release gates. |
bntvllnt
added a commit
that referenced
this pull request
Aug 31, 2026
## Summary - prepare `@vllnt/typescript@2.0.0` for the stable TypeScript 7.0.2 compiler while retaining the official TypeScript 6 compatibility API for tools such as `typescript-eslint` - make TypeScript 7 defaults explicit (`types: []`, stable ordering, side-effect import checks, no lib replacement) and document the breaking v1-to-v2 migration - replace JSON-only smoke tests with TypeScript 6/7 compiler fixtures, declaration/runtime checks, installed-tarball validation, and real React/Vite and Next.js builds - standardize the repository on pnpm, Vitest coverage, Prettier, ESLint, a deterministic lockfile, exact package exports, and complete public docs - harden CI and npm OIDC publishing with SHA-pinned actions, immutable artifact verification, main-only reviewed stable releases, provenance, and retry-safe tag/package reconciliation ## 2.0.0 canary behavior `package.json` is intentionally set to `2.0.0`. After this PR merges to `main`, the push workflow publishes: ```text 2.0.0-canary.<short-sha> ``` under the npm `canary` dist-tag. It does **not** move `latest`. Stable `2.0.0` remains a separate, manually reviewed environment deployment from the already-versioned `main` commit. ## Breaking changes - TypeScript 5 is no longer supported; the peer range is `>=6.0.2 <8`. - Ambient type packages are opt-in and must be listed in each consumer's `types` array. - Emitting projects must set `rootDir` explicitly. - Consumers using JavaScript-API tooling should follow the documented TypeScript 6/7 side-by-side installation. ## Verification - `pnpm check` - formatting and linting pass - 11 compiler/package tests pass - 100% statements, branches, functions, and lines for test helpers - React 19.2.8 / Vite 8.2.2 build passes - Next.js 16.3.3 native TypeScript 7 build passes - `pnpm audit --audit-level high` — no known vulnerabilities - `pnpm pack --dry-run --json` — exact 11-file public package surface - TypeScript 7.0.2 and TypeScript 6 compatibility compiler both validated - independent release-gate re-review — no blockers found ## Repository settings The `npm` GitHub environment now requires maintainer review and restricts deployments to protected branches. No package, stable release, tag, or merge was created by this PR update. Closes #2 Closes #3 Closes #4 Closes #5 Closes #6 Supersedes #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@vllnt/typescript:CHANGELOG.md,CONTRIBUTING.md,SECURITY.md,AGENTS.md,llms.txt, andllms-full.txtVerification
npm test(3 tests passed)npm pack --dry-rungit diff --check HEAD~1..HEADReview gate
{"branch":"vllnt-oss","tenant":"releases","aor_fit":true,"context_read":true,"evidence_attached":true,"opsec_checked":true,"safe_for_next_step":true,"blocking_findings":[]}