[harlantwood]

TL;DR

This is roadmap Phase 2, "Release and publish". Once the release-plz PR is merged, the vX.Y.Z tag it pushes publishes trust binaries and installers to a GitHub Release, a Homebrew formula, the crates on crates.io, and both npm packages with provenance. Nothing is published yet and no secrets exist. Release-plz skips itself until its token is set, and PRs never need secrets. doc/releasing.md lists the one-time setup.

Binaries (dist 0.33)

• dist-workspace.toml sets the targets: trust for Linux gnu and musl (x86_64, aarch64), macOS (x86_64, aarch64) and Windows x86_64. It also sets up the shell and PowerShell installers, the Homebrew formula trustgraph (pushed to trustgraph/homebrew-tap), GitHub build attestations, precise-builds (builds only trustgraph-cli) and installs to $XDG_BIN_HOME or ~/.local/bin. Cargo.toml gains [profile.dist].
• .github/workflows/release.yml is generated by dist generate. On PRs it only runs dist plan. Its action versions are pinned in [dist.github-action-commits] (checkout@v7 and so on), and Dependabot skips the file (exclude-paths), because dist's CI fails when the file is edited by hand.

install.sh

• It stays the stable curl | sh entry point. It downloads trustgraph-cli-installer.sh from the latest release (or TRUST_VERSION) and runs it. That installer detects glibc or musl, checks the SHA-256 and sets up PATH. When there is no release, it falls back to cargo install.
• TRUST_INSTALL_DIR is passed on, and so are any arguments (sh -s -- --no-modify-path). TRUST_FROM_SOURCE=1 forces a source build.
• The README gains the PowerShell one-liner, the Homebrew command and cargo install trustgraph-cli.

Crates (release-plz)

• release-plz.yml and release-plz.toml: there is one shared version and one root CHANGELOG.md, and the tag is v{{ version }} on trustgraph-cli. The GitHub Release is left to dist. release_always = false, so a release happens only when the release PR is merged.
• crates.io auth: CARGO_REGISTRY_TOKEN is used if it is set. Without it, release-plz uses trusted publishing (OIDC). The empty secret is never passed on, because release-plz treats an empty token as an error.
• trustgraph-core and trustgraph-cli are now publishable. trustgraph-wasm and trustgraph-node stay publish = false. The crate README links are now absolute.

npm (npm.yml)

• Triggers: it publishes on v* tags. PRs that touch the npm pipeline, and manual runs, do everything else and finish with pnpm publish --dry-run.
• Native builds: napi-rs v3 builds the 8 targets from package.json. Linux gnu builds use --use-napi-cross, which gives an old glibc. Linux musl builds use -x (zig).
• Smoke tests: native on macOS arm64 and Windows x64, and in Docker for glibc and musl Linux on x86_64 and arm64, plus Node 22.
• Native packages: the publish job assembles the per-platform packages (napi create-npm-dirs / napi artifacts) and the root package's optionalDependencies.
• @trustgraph/trustgraph-wasm: built by scripts/build-wasm-package.sh, which now also copies README and LICENSE into the package.
• scripts/npm-publish.sh: publishes with pnpm publish --provenance --access public. It skips versions that are already on npm, so a failed run can be re-run, and sends prereleases to the next tag.
• Versions and auth: package versions come from the tag, which is checked against Cargo.toml. Auth is npm trusted publishing, or an optional NPM_TOKEN.

CI

• deny job: EmbarkStudios/cargo-deny-action@v2 with deny.toml. Advisories and yanked crates fail the build. The license allowlist is compatible with Apache-2.0 (MPL-2.0 is allowed for option-ext). Duplicate crate versions only warn. Unknown registries and git sources fail.
• coverage job: cargo-llvm-cov over the Rust crates. It uploads lcov.info and an HTML report as an artifact and adds a summary to the job. No external service is involved.

Docs

• doc/releasing.md covers what ships where, how to cut a release, the one-time setup, how to check the pipeline without publishing, and how to change the setup.
• The setup steps are: RELEASE_PLZ_TOKEN; a crates.io token for the first release, then trusted publishing; creating trustgraph/homebrew-tap and adding HOMEBREW_TAP_TOKEN; the npm @trustgraph org with NPM_TOKEN for the first release, then trusted publishers for all 10 packages.
• doc/architecture.md now points to it.

Verified

• cargo fmt --check, plus clippy -D warnings on the workspace and on core alone, with both stable 1.97 and 1.99. Also cargo doc -D warnings, cargo test --workspace, check-core-purity.sh and shellcheck install.sh scripts/*.sh.
• cargo publish --dry-run -p trustgraph-core -p trustgraph-cli passes (package, verify build and aborted upload for both).
• dist plan lists the expected 7 archives, the installers and trustgraph.rb. dist build --artifacts=all --target x86_64-unknown-linux-gnu produced a working archive. Hand-editing release.yml makes dist plan fail, as expected.
• End to end: I ran the modified install.sh against a local copy of target/distrib. It installed trust 0.1.0 to ~/.local/bin, and to TRUST_INSTALL_DIR with --no-modify-path. With no release it falls back to cargo install from git.
• cargo deny check: all ok. One warning: duplicate syn.
• cargo llvm-cov: about 94% line coverage; the HTML report is generated.
• napi: napi build --use-napi-cross --target x86_64-unknown-linux-gnu builds, needs only GLIBC_2.14 and passes the smoke test. I ran a fake run of create-npm-dirs + artifacts + the optionalDependencies step + npm-publish.sh --dry-run for all 9 native packages. The wasm package passed build, smoke test, pnpm pack contents check and a dry-run publish.
• actionlint on the workflows: clean, apart from style notes in the generated release.yml.

Not in this PR

• No release-plz run: building it locally ran out of disk. Its config was checked against the release-plz docs at its current version.
• The secrets, the tap repository, the npm org and the trusted publishers all need the owner (see doc/releasing.md).
• Still open from the roadmap: package names and whether the npm scope is public. The workflows publish publicly.
• The Convex spike from Phase 2.
• Self-update via the dist updater is left off (install-updater = false).

🤖 Generated with Claude Code

https://claude.ai/code/session_01UdKneRqUnsbv1t7NyvcT68

---

Generated by Claude Code