Defer npm publishing setup

Author: aezell

.github/dependabot.yml

@@ -8,6 +8,11 @@ updates:
     groups:
       development-dependencies:
         dependency-type: development
+    ignore:
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: typescript
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: github-actions
     directory: /

.github/workflows/ci.yml

@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: npm
@@ -42,10 +42,10 @@ jobs:
     timeout-minutes: 20
     environment: pi
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: npm

.github/workflows/publish.yml

@@ -1,20 +1,25 @@
-# Releasing pi-sprites
+# Future npm releases
 
-Releases are published from GitHub Actions with npm trusted publishing. The workflow uses short-lived OIDC credentials and stores no long-lived npm write token in GitHub.
+`pi-sprites` is not currently published to npm, and this repository does not contain an active npm publishing workflow. Users should install directly from GitHub until maintainers announce otherwise.
 
-## One-time setup
+```bash
+pi install git:github.com/superfly/pi-sprites
+```
 
-The `pi-sprites` npm name is not yet published. A package owner must claim it with the initial public publish, then configure trusted publishing for subsequent releases:
+## Deferred setup checklist
+
+When npm publishing becomes available, a package owner should:
 
 1. Make this GitHub repository public.
 2. From a clean, reviewed `main` checkout, run `npm ci`, `npm run check`, and `npm run pack:check`.
-3. Authenticate to the intended Fly.io npm owner account and publish `0.1.0` with `npm publish`. The package's `publishConfig` makes it public.
-4. In the npm package settings, configure a GitHub Actions trusted publisher with:
+3. Confirm ownership of the intended unscoped `pi-sprites` npm name and perform the initial public publish through the approved Fly.io npm account.
+4. Add a reviewed `.github/workflows/publish.yml` that validates the release tag, runs checks, and invokes `npm publish` with OIDC permissions.
+5. In the npm package settings, configure a GitHub Actions trusted publisher with:
    - organization: `superfly`
    - repository: `pi-sprites`
    - workflow filename: `publish.yml`
    - allowed action: `npm publish`
-5. Remove or restrict traditional npm automation tokens after the trusted publisher succeeds.
+6. Remove or restrict traditional npm automation tokens after the trusted publisher succeeds.
 
 Do not add an `NPM_TOKEN` secret to this repository. Trusted publishing automatically attaches npm provenance when both the repository and package are public.
 
@@ -23,8 +28,6 @@ Do not add an `NPM_TOKEN` secret to this repository. Trusted publishing automati
 1. Update `version` in `package.json` and `package-lock.json`.
 2. Move the relevant entries from `Unreleased` in `CHANGELOG.md` into a versioned section with the release date.
 3. Open and merge a pull request after CI passes.
-4. Publish a GitHub release whose tag is exactly `v<package-version>`.
-
-The [publish workflow](../.github/workflows/publish.yml) verifies that the release tag matches `package.json`, installs the locked dependencies, runs the full local check and package dry run, then calls `npm publish`. npm trusted publishing supplies the short-lived credential and provenance.
+4. Publish a GitHub release whose tag is exactly `v<package-version>` after the trusted-publishing workflow is configured.
 
-The gated live Sprites test runs on the trusted `main` push before release. It is not rerun by the publish workflow so the npm release path needs no Sprites credential.
+The gated live Sprites test already runs on trusted `main` pushes. A future publish workflow should rely on that result rather than requiring a Sprites credential in the npm release path.

docs/releasing.md

@@ -13,9 +13,6 @@
   "bugs": {
     "url": "https://github.com/superfly/pi-sprites/issues"
   },
-  "publishConfig": {
-    "access": "public"
-  },
   "keywords": [
     "pi-package",
     "pi",