docs: add RELEASING.md documenting OIDC publishing and retry process

Describes how packages publish (release.yml + release environment,
trusted publishing on npm and PyPI, no registry tokens, provenance),
what a release run does, and how to recover from a failed publish leg
(rerun --failed within the window, or ride the next release). Linked
from the root README alongside the other maintainer docs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
This commit is contained in:
cliffhall 2026-07-04 16:08:50 -04:00
commit 1c0fdc3063

View file

@ -145,6 +145,10 @@ See [ADDITIONAL.md](ADDITIONAL.md) for a curated list of frameworks and resource
See [CONTRIBUTING.md](CONTRIBUTING.md) for information about contributing to this repository.
## 📦 Releasing
See [RELEASING.md](RELEASING.md) for how packages are published (OIDC trusted publishing from CI — no registry tokens) and how to retry a failed publish.
## 🔒 Security
See [SECURITY.md](SECURITY.md) for reporting security vulnerabilities.