Release process: one-time setup

[aaronschweig]

Setup tasks required before the first real release via release.yaml (see RELEASING.md → "How releases are secured"). These are one-off; close this issue once all are done.

GitHub release environment

• Create environment release under Settings → Environments
• Deployment branches and tags → Selected branches: allow only main and release/*
• (Recommended) Add Required reviewers; ensure the approver differs from the person triggering the run

npm Trusted Publishing (OIDC) — both packages

For @openmfp/webcomponents and @openmfp/ngx (Package → Settings → Trusted Publishing → GitHub Actions):

• Repository: openmfp/webcomponents, Workflow: release.yaml
• Environment: release (must match the GitHub environment name)
• Confirm no long-lived npm token remains configured

Until this is configured for both packages, the publish step fails.

Branch protection

• Make the PR Title check required on main
• Allow github-actions[bot] to bypass push protection on main and release/* (or supply a token) — the release job commits CHANGELOG.md + version bump back to the branch

Retire the old per-package environments

• Delete unused environments npmjs:@openmfp/ngx and npmjs:@openmfp/webcomponents (superseded by the neutral release environment)

Follow-up — enable lint and check-format in CI

CI ships with npm run lint and npm run check-format commented out (pre-existing files fail them; the previous pipeline ran neither).

• Run npm run lint:fix and npm run format repo-wide (a couple of lint errors need manual fixes)
• Commit the result
• Uncomment both steps in .github/workflows/pipeline.yaml

Validation

• Run release.yaml with dry-run: true on main as the first check after merge