Clarify trusted publishing release docs

Author: Brian M Hunt

.github/workflows/release.yml

@@ -1,7 +1,7 @@
 # Automated release via Changesets.
 #
 # On push to main:
-#   - If there are unreleased changesets, opens/updates a "Version Packages"
+#   - If there are unreleased changesets, opens/updates a release version
 #     PR that bumps versions and updates changelogs.
 #   - If there are no unreleased changesets, builds, tests, and publishes
 #     to npm from a separate least-privilege job.
@@ -30,9 +30,11 @@ jobs:
 
     steps:
       - name: Checkout code
+        # actions/checkout v6.0.2
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Setup Node.js
+        # actions/setup-node v6.3.0
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
         with:
           # npm trusted publishing requires npm CLI 11.5.1+, which is available
@@ -46,6 +48,7 @@ jobs:
 
       - name: Create or update version PR
         id: changesets
+        # changesets/action v1.5.3
         uses: changesets/action@e0145edc7d9d8679003495b11f87bd8ef63c0cba
         with:
           version: npx changeset version
@@ -69,9 +72,11 @@ jobs:
 
     steps:
       - name: Checkout code
+        # actions/checkout v6.0.2
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Setup Node.js
+        # actions/setup-node v6.3.0
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
         with:
           # npm trusted publishing requires npm CLI 11.5.1+, which is available

README.md

@@ -55,7 +55,7 @@ It's available as `@tko/build.knockout`, and over CDN:
 | $ `make test` | Run all tests with electron. See below. |
 | $ `make test-headless` | Run all tests with chromium. See below. |
 | $ `npx changeset add` | Add a changeset for package behavior changes in your PR |
-| $ `Release workflow` | On merge to `main`, CI opens or updates a version PR and publishes from GitHub Actions via npm trusted publishing |
+| Release workflow | On merge to `main`, CI opens or updates a version PR; when that version PR is merged and there are no remaining changesets, CI publishes from GitHub Actions via npm trusted publishing |
 | $ `make test-coverage` | Run all tests and create a code coverage report |
 
 Checkout the `Makefile` for more commands that can be executed with `make {command}`.