ci, docs: harden the publish workflow and document releasing

[gnidan]

Follow-ups from the first prerelease (0.1.0-1), one commit each, plus a review-fix commit.

publish.yml now grants id-token: write to the publish job only; the check job gets contents: read. The tag check captures git tag --points-at HEAD into a variable before grepping it: under shell: bash (which adds -o pipefail) grep -q can kill git with SIGPIPE and turn a match into tagged=false. A comment above the concurrency group records that GitHub still cancels a pending run in the group when a newer one queues, so a Publish commit whose run shows "cancelled" has to be re-run from the Actions UI.

@ethdebug/bugc was the one package npm 11 warned about at publish time ("auto-corrected some errors in your package.json"). The cause is bin.bugc written as ./dist/bin/bugc.js: npm normalizes it to dist/bin/bugc.js and warns. The manifest now uses the normalized form, which is exactly what npm pkg fix produces, and npm publish --dry-run under npm 11 no longer warns. The manifest on the registry for 0.1.0-1 already has the normalized form, so nothing changes for consumers.

The index.ts comments in pointers-react and programs-react told consumers to import @ethdebug/<pkg>/components/*.css. Neither package has an exports map and the stylesheets ship under dist/src/components/, so those paths never resolved. The comments now show the real path and list the available files; pointers-react's notes that variables.css must come first, since the component stylesheets use its custom properties without fallbacks.

RELEASING.md is the runbook: versioning model (including that Lerna bumps only packages changed since their last tag plus dependents, and --force-publish for lockstep), the explicit-version lerna version command and why each flag is there (lerna version prerelease yields 0.1.0-alpha.0 because Lerna's preid falls back to "alpha"; --no-commit-hooks keeps lint-staged off the Publish commit; --no-push avoids Lerna's silent non-atomic retry and --no-verify), the atomic push and its recovery, what the workflow and bin/publish-tagged.ts do, the trusted-publisher setup on npmjs.com and the order of operations for a brand-new package, re-running and dispatching, the local fallback, the tarball guards, and the known limits (prereleases under latest; a stage-only trusted publisher would force a rewrite, tracked in #296).

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-09-17 00:36 UTC