zkp2p-contracts-publish

Automating smart contract package publishing to npm involves orchestrating releases through GitHub Actions with OIDC provenance, eliminating local developer credentials. This pipeline manages preflight validation, registry publication, and post-publish recovery for production-grade deployments.

OIDC provenance for smart contract release management is needed to satisfy strict security requirements for contract integrity and authorized release-line management. It eliminates the risks of manual contract releases by providing a standardized, audit-ready, and secure publishing pipeline.

Validating Foundry version and package manifests before publishing smart contracts requires automated preflight release verification checks. This ensures pinned dependency gating and registry integrity verification pass before dispatching the secure publishing workflow.

Performing a dry-run for smart contract releases against the canonical main branch is supported. When a new version is ready, initiate a release audit for the current repository state to validate the release before dispatching the secure publishing workflow.

Security limitations of manual smart contract package releases include risks to contract integrity and the lack of immutable versioning. Manual releases lack standardized audit trails and authorized release-line management, which secure automated pipelines with GitHub OIDC provenance are designed to mitigate.

The zkp2p-contracts-publish skill supports post-publish recovery for npm packages as part of its end-to-end release lifecycle automation. It applies to production-grade deployment pipelines requiring immutable versioning and strict contract integrity verification.