[ ] = not done, or not verified; the note on the line says which.
Completed items are moved to CHANGELOG.md; the fix pass of 2026-10-07/08
(781c6e0) and the improvement and comparison passes of 2026-10-09 are
described there under Unreleased.
- Publish 0.1.0: push the tag
v0.1.0on the branch the workflow runs from.package.json,VERSIONandCITATION.cffare at 0.1.0; the workflow fails if the tag andpackage.jsondisagree. The published 0.0.2 contains only LICENSE, README and package.json, no CSS or SCSS. The rewritten publish workflow has not run yet. - Optional: register
.github/workflows/publish_package.ymlas a trusted publisher forboot.glon npmjs.com, then dropPUBLISH_NPM_TOKEN. Until then npm publishes with the token (with provenance).- Decided 2026-10-10: yes: register the workflow as an npm trusted publisher (OIDC, with provenance) and drop
PUBLISH_NPM_TOKEN. Same for move.gl, font.gl, icon.gl, hue.gl, unit.gl (fleet decision). - Partly done 2026-10-10: repo side is ready.
publish_package.ymlhasid-token: write, npm >= 11.5.1 and--provenance, so it uses OIDC as soon as a trusted publisher exists. Left to do on npmjs.com: packageboot.gl> Settings > Trusted Publisher > GitHub Actions, organizationstylescape, repositoryboot.gl, workflowpublish_package.yml. Only after the first OIDC publish succeeds, removeNODE_AUTH_TOKENand thePUBLISH_NPM_TOKENsecret (removing it earlier breaks the fallback).
- Decided 2026-10-10: yes: register the workflow as an npm trusted publisher (OIDC, with provenance) and drop
- Deploy the docs:
deploy_docs.ymlonly runs onmain/master, so the rewritten docs go live oncedevis merged there.- Partly done 2026-10-10: the trigger stays on
main/masteron purpose (devis the default branch, butmkdocs gh-deploy --forcewould publish unreleased docs). Addedworkflow_dispatchfor a manual run, and quotedmkdocstrings[python]>=0.18(unquoted, the shell treats>=0.18as a redirect and the version bound is lost).mkdocs build --strictpasses locally. Left: mergedevintomain, or run the workflow by hand.
- Partly done 2026-10-10: the trigger stays on
- The reboot is a fork of Bootstrap 5's Reboot, so Bootstrap fixes do
not reach it. Compare it with
scss/_reboot.scssof each Bootstrap release and port what applies; last compared: never.- Partly done 2026-10-10: the procedure and a tracking table are in
.github/CONTRIBUTING.md(Upstream tracking). The first comparison itself is still to do, against the Bootstrap 5.3.x release of 2025-05-23, when the fork was made (exact release not recorded).
- Partly done 2026-10-10: the procedure and a tracking table are in