root - chore: defense - stage npm publishes

[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing guidelines and Code of Conduct
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

This chore changes the release workflow only. No new test is required.

What kind of change does this PR introduce?

Chore. The release job packs the package and stages the tarball.

Summary

Section 5 switches the release publish step to pnpm stage publish.

The release job packs @hyphen/sdk into packed/.
pnpm stage publish sends that tarball to the npm staging queue.
The command is pnpm stage publish ./packed/*.tgz --access public --provenance --no-git-checks.

Status

DEFENSE_IN_DEPTH.md:

• Workflow name: and job name: contain no spaces → PR root - chore: defense - use kebab-case workflow names #169
• No npm tokens (or other registry credentials) in Actions secrets → verified 2026-10-11
• .github/workflows/release.yaml packs then stages with pnpm stage publish ./packed/*.tgz --no-git-checks → (PR root - chore: defense - stage npm publishes #170 pending)

These items stay open. Each one is manual:

• OIDC trusted publishing is stage-only on npmjs.com
• A maintainer promotes a staged version with 2FA
• Drydock reviews the staged release
• The package requires 2FA and disallows tokens

Verification

• Local zizmor 1.30.1 in offline mode reports no findings for release.yaml.
• pnpm pack --pack-destination writes a tarball that contains dist/.
• pnpm stage publish ./packed/*.tgz --access public --provenance --no-git-checks --dry-run accepts the flags and skips the upload.
• This pull request does not add, change, or delete a test. The test-audit gate does not apply.

Reference

defense-in-depth-nodejs § 5

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T21:46:09.062993Z	467f0d7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[gemini-code-assist]

Code Review

This pull request updates the DEFENSE_IN_DEPTH.md file to mark several security checklist items as completed or pending, specifically regarding workflow naming conventions, the verification of npm token secrets, and the status of the release workflow. No review comments were provided, so there is no feedback to address.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (07563bc) to head (c5423ae).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #170   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines          639       639           
  Branches       151       146    -5     
=========================================
  Hits           639       639           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.