- On npmjs.com → package settings → Trusted Publisher:
- Provider: GitHub Actions
- Organization/user:
perawallet - Repository:
pera-walletconnect-ts - Workflow filename:
release.yml - Environment:
npm-publish
- Package settings → Publishing access: require two-factor authentication
and disallow tokens (trusted publisher only).
First-ever publish of a new package name cannot use a trusted publisher;
do the initial
npm publish --provenance --access publiclocally with an npm account that has 2FA, then immediately configure the trusted publisher and disable token publishing.
- Settings → Environments → create
npm-publish; add required reviewers (release approvers). - Branch protection on the default branch: require pre-merge checks.
- Bump
versioninpackages/walletconnect/package.jsonvia PR. - After merge:
git tag vX.Y.Z && git push origin vX.Y.Z. - Approve the
npm-publishenvironment run when prompted. - Verify the provenance badge on https://www.npmjs.com/package/@perawallet/walletconnect.