From e0783886b7c27d63313a3218945ceab013b2c2ec Mon Sep 17 00:00:00 2001 From: Altay Date: Mon, 5 Oct 2026 14:19:51 +0300 Subject: [PATCH] docs: describe what the scan does on manual dispatch Actionlint and Zizmor lint every workflow on dispatch; full history is what Gitleaks scans, and Gitleaks stays off for this public repository. Also list manual dispatch among the verify job's triggers. --- docs/DISTRIBUTION.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md index 802e335..ddef949 100644 --- a/docs/DISTRIBUTION.md +++ b/docs/DISTRIBUTION.md @@ -6,12 +6,12 @@ Merges to `main` are considered publishable. The CI workflow runs: -1. `verify` on pull requests and `main` pushes. +1. `verify` on pull requests, `main` pushes, and manual dispatch. 2. semantic-release on `main` after `verify` passes. semantic-release analyzes Conventional Commits; a releasable commit publishes to npm, creates a GitHub Release, and commits the released `package.json` version back to `main` with `[skip ci]`. -The release job calls the [shared frontend release workflow](https://github.com/putdotio/.github) from `putdotio/.github`, pinned to a reviewed commit SHA; the semantic-release action and plugin pins live there. The `verify` job ends with the shared [links](https://github.com/putdotio/.github#actionslinks) and [scan](https://github.com/putdotio/.github#actionsscan) actions from the same repository: an offline Markdown link and anchor check on every run, and an Actionlint and Zizmor audit when a `main` push changes workflows, or of the full history on manual dispatch. +The release job calls the [shared frontend release workflow](https://github.com/putdotio/.github) from `putdotio/.github`, pinned to a reviewed commit SHA; the semantic-release action and plugin pins live there. The `verify` job ends with the shared [links](https://github.com/putdotio/.github#actionslinks) and [scan](https://github.com/putdotio/.github#actionsscan) actions from the same repository: an offline Markdown link and anchor check on every run, and an Actionlint and Zizmor audit when a `main` push changes workflows and on manual dispatch. GitHub secret scanning and push protection cover secrets in this public repository. ## Release Credentials