# ReleaseOrigin static handoff outline
# Variant: GitLab CI + npm, one package
# DOCUMENTATION ONLY — this file is intentionally not a runnable CI file.
# It contains no dependency install, lifecycle-script, credential, or publish step.

releaseorigin_reference:
  provider: gitlab-ci
  package_manager: npm
  accepted_scope:
    packages: 1
    repositories: 1
    release_workflows: 1
    hosted_ci_paths: 1
    consolidated_revisions: 1
  owner_confirms:
    - exact npm package name
    - package-declared public GitLab repository
    - existing release stage, job, and owner-approved trigger
    - supported GitLab.com runner and identity path against current npm documentation
    - authorized npm publisher and GitLab project owner
  static_review:
    - parse proposed CI structure without running it
    - record proposed identity-token audience and minimum job permissions
    - identify legacy release-token references by name, never by value
    - compare package metadata with the accepted release job
    - document rollback to the last reviewed CI revision
  customer_controlled_checklist:
    - review the exact proposed diff
    - configure trusted publisher in the customer-controlled npm account
    - run any dry run only in the customer's controlled environment
    - merge and trigger publication only through an authorized publisher
  deliberately_omitted:
    - executable CI job
    - dependency installation
    - package lifecycle execution
    - token or credential values
    - npm account mutation
    - package publication