release-process

You can prevent npm publishing disasters by enforcing a release runbook that gates versioning with strict semver validation, requires a clean git state on the main branch, and mandates an NPM automation token before publishing.

Publishing an npm package from the main branch safely requires a clean git state, disabled build bump scripts, semver validation, git tagging, and an NPM automation token to ensure a clean, auditable release.

Semver validation during a CI-CD npm release works by gating the version bump step, ensuring the proposed version number strictly follows semantic versioning rules before allowing any git tagging or npm publishing to proceed.

Yes, you need an NPM automation token to publish during a release runbook. The process explicitly requires an automation token to authenticate package publishing and prevent unauthorized or incorrect deployments.

To rollback a failed npm package release, follow the runbook's rollback procedures which support manual publish fallbacks to revert version bumps and recover from incomplete or mis-bumped deployments safely.

You should disable bump-build.mjs during an npm release to prevent automated build scripts from overriding the manually validated version bump, ensuring the git tag and npm package version remain consistent and auditable.