# ReleaseOrigin static handoff outline
# Variant: GitHub Actions + npm, one package
# DOCUMENTATION ONLY — this file is intentionally not a runnable workflow.
# It contains no dependency install, lifecycle-script, credential, or publish step.

releaseorigin_reference:
  provider: github-actions
  package_manager: npm
  accepted_scope:
    packages: 1
    repositories: 1
    release_workflows: 1
    hosted_ci_paths: 1
    consolidated_revisions: 1
  owner_confirms:
    - exact npm package name
    - package-declared public repository
    - existing release workflow path and trigger
    - supported hosted runner eligibility against current npm documentation
    - authorized npm publisher and repository owner
  static_review:
    - parse proposed workflow structure without running it
    - record proposed minimum repository permissions
    - identify legacy release-token references by name, never by value
    - compare package metadata with the accepted workflow path
    - document rollback to the last reviewed workflow revision
  customer_controlled_checklist:
    - review the exact proposed diff
    - configure trusted publisher in the customer-controlled npm account
    - run any dry run only in the customer's controlled environment
    - merge and trigger publication only through an authorized publisher
  deliberately_omitted:
    - executable workflow trigger
    - dependency installation
    - package lifecycle execution
    - token or credential values
    - npm account mutation
    - package publication