[jcary741]

Releases and the docs site are automatically from a single main branch, replacing the tag-based npm release and the Publisher deploy.

Running workflow manually on a branch deploys docs to staging.

Blocked by https://github.com/mapbox/gitops-infra/pull/2814

TODO

Before merge:

• Ensure Trusted Publishing is configured for this repo in npmjs.

After merging:

• Rename publisher-staging to main; the workflow only runs on main.
• Archive publisher-production. Its tree is identical to publisher-staging; its only extra commit is the 2026-10-16 release merge.
• Update branch protection.
• The first push to main deploys the docs to both labs sites. It publishes to npm only if a fix: or feat: commit came in.

[ox-security]

Successfully scanned changes introduced in a pull request into publisher-staging from update-ci.

Internal scan identifier: dffdbe5e-c62c-40f8-adbc-ccd2ac4f5dc6.

Total issues	Blocking issues	Scan status
1	0	✔️

Category	Issues
Open Source Security	1

See all issues found during this scan in the OX Security Application.

Detailed information

Issue #	1
Name	postcss@8.5.6 • 4 direct + 4 indirect CVEs • Public Exploit • EPSS Low
Status	Old
Enforcement	Monitor
Severity	High
Category	Open Source Security
Source tools	OX Open Source Security
Recommendation	• Current Dependency: postcss@8.5.6 • Recommended Upgrade: postcss@8.5.30 • postcss@8.5.30 resolves 4 of 4 direct vulnerabilities and resolves 4 of 4 indirect vulnerabilities Upgrading to postcss@8.5.30 will resolve ALL known vulnerabilities in your current dependency.

1 aggregation

File	Match
package.json	postcss@8.5.6