feat: require manual approval before npm publish + drop release-as pin

[kevincodex1]

Summary

Two post-launch hardening changes to the release pipeline, now that v0.1.0 has shipped to npm:

• Manual approval gate before npm publish. The publish-npm job in release-artifacts.yml now targets a npm-publish deployment environment. With a required-reviewer rule on that environment, every release pauses after the GitHub Release and platform artifacts are published, and nothing reaches the npm registry until a maintainer approves the job in the Actions UI. The environment also carries the package URL so the approval prompt links straight to npmjs.com.
• Remove the release-as: 0.1.0 pin from release-please-config.json. It existed only to force the version of the first release; now that v0.1.0 is tagged and published, leaving it in place would stamp every future release as 0.1.0. Versions are computed from conventional commits from here on.

Post-merge setup (one-time): GitHub auto-creates a referenced environment without protection rules, so the gate is only real once configured — Settings → Environments → npm-publish → add Required reviewers. Optionally set npm-publish as the environment in the npmjs.com trusted-publisher config to bind OIDC publishing exclusively to approved runs (names must match exactly).

Linked issue

Fixes #

Checklist

• The linked issue already has the issue-approved label.
• go build ./..., go vet ./..., and go test ./... pass locally.
• gofmt clean.
• Tests added/updated for the change (and run under -race where relevant). — N/A: no Go code changed; workflow YAML and config JSON re-validated by parsing.
• UI changes include screenshots or a short recording where possible. — N/A: CI/config only.

Summary by CodeRabbit

• Chores
  • Added a manual approval step for NPM publishing on tagged releases, helping control when package releases go live.
  • Updated release configuration to rely on the package’s standard release settings instead of a fixed version override.

[github-actions]

Zero automated PR review

Verdict: No blockers found

Blockers

• None found.

Validation

• [pass] Diff hygiene: git diff --check
• [pass] Tests: go test ./...
• [pass] Build: go run ./cmd/zero-release build
• [pass] Smoke build: go run ./cmd/zero-release smoke

Scope

Head: 5ea2b8682574
Changed files (2): .github/workflows/release-artifacts.yml, release-please-config.json

This deterministic review checks validation status and basic diff hygiene. A human reviewer still owns product judgment and design quality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8548a914-3249-48bf-8f63-8e8d2b480ee3

📥 Commits

Reviewing files that changed from the base of the PR and between c807f92 and 5ea2b86.

📒 Files selected for processing (2)

• .github/workflows/release-artifacts.yml
• release-please-config.json

---

Walkthrough

This PR adds a manual approval environment gate (npm-publish) to the npm publishing job in the release-artifacts workflow, and removes the release-as version override from the release-please configuration's package entry.

Changes

Release CI and Config Adjustments

Layer / File(s)	Summary
Manual approval gate for npm publish .github/workflows/release-artifacts.yml	Adds an environment: npm-publish block with a package URL to the publish-npm job, requiring manual approval before publish steps run.
Release version config cleanup release-please-config.json	Removes the release-as: 0.1.0 override, leaving only package-name: "@gitlawb/zero" in the packages configuration.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Related Issues: None referenced.

Related PRs: None referenced.

Suggested labels: ci, release

Suggested reviewers: None specified.

🐇 A gate now guards the npm release,
No auto-tag to disturb the peace,
One override snipped away with care,
A tidier config, less to compare,
Ship it manually — release please!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the two main changes: adding manual approval before npm publish and removing the release-as pin.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/npm-publish-approval

---

_{Comment @coderabbitai help to get the list of available commands.}

[Vasanthdev2004]

Verdict: Approve ✅

Two small, correct, low-risk release-pipeline changes. Verified both against the current main config.

1. npm-publish environment gate — correct

• Job-level environment: { name, url } is valid Actions schema; url points at the real package (@gitlawb/zero). ✔
• OIDC interaction checked: referencing an environment adds environment:npm-publish to the OIDC sub claim. npm trusted publishing treats the environment as an optional matcher, so publishing keeps working whether or not the npmjs.com trusted-publisher config names an environment — and if it later does, it must match exactly (the PR body already says so). No regression to the existing OIDC path. ✔

2. Dropping release-as: 0.1.0 — correct and necessary

• .release-please-manifest.json records {".":"0.1.0"}, so the version baseline is preserved; future releases are computed from conventional commits. Leaving the pin in would have stamped every release as 0.1.0. ✔

⚠️ One required post-merge action (not a code defect)

GitHub auto-creates a referenced environment without protection rules, so merging this alone does not gate anything — the next tagged release would still publish to npm unattended until a maintainer sets Settings → Environments → npm-publish → Required reviewers. The PR body documents this, but it's worth tracking as a hard follow-up so the gate isn't silently inert. Recommend doing it immediately after merge (before the next v* tag), and optionally binding the environment name in the npmjs.com trusted-publisher config for defense-in-depth.

No blocking issues. CI/config-only, no Go changes; build/vet/test + gofmt claims are consistent with the diff.