feat: initialize Hypothesis Machine Pi extension

2026-07-31 22:36:16 +03:00
commit 528983ee50
57 changed files with 7790 additions and 0 deletions
@@ -0,0 +1,31 @@
+# Releasing
+
+This checklist prepares a GitHub release. Publishing to npm is intentionally not
+part of the current project workflow.
+
+1. Confirm the worktree contains only intended changes and no runtime state,
+   fetched sources, datasets, credentials, or package archives.
+2. Update the version in `package.json` and `package-lock.json` together.
+3. Move release notes into a dated section of `CHANGELOG.md`.
+4. Run:
+
+   ```bash
+   npm ci
+   npm run check
+   docker compose -f infra/compose.yaml config --quiet
+   npm audit
+   npm pack --dry-run
+   ```
+
+5. Verify the extension manually with the oldest supported Pi and the recommended
+   Pi version. A real-model recursive run is a manual release check, not CI.
+6. Merge through a reviewed pull request and confirm CI and CodeQL are green.
+7. Create an annotated `vX.Y.Z` tag from `main` and a GitHub release using the
+   matching changelog section.
+
+`npm audit` currently reports the upstream Pi shrinkwrap advisory documented in
+[`security.md`](security.md). Confirm that the finding still has exactly that
+provenance; any additional high/critical finding blocks a release.
+
+Before the first public release, enable private vulnerability reporting and
+branch protection for `main` in the GitHub repository settings.