# Release: bug report rules and npm Trusted Publisher

.github/workflows/release.yml

@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write # Required for npm Trusted Publisher (OIDC)
 
 jobs:
   release:
@@ -50,9 +51,10 @@ jobs:
         run: npm version ${{ steps.version.outputs.version }} --no-git-tag-version
 
       - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm publish --access public
+        # setup-node may set NODE_AUTH_TOKEN; unset so OIDC trusted publishing is used
+        run: |
+          unset NODE_AUTH_TOKEN
+          npm publish --access public
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v1

CHANGELOG.md

@@ -1,3 +1,11 @@
+# [1.1.0-beta.1](https://github.com/mi-examples/qa-ai-rules/compare/v1.0.1...v1.1.0-beta.1) (2026-05-22)
+
+
+### Features
+
+* **rules:** add bug report template ([7bf6a92](https://github.com/mi-examples/qa-ai-rules/commit/7bf6a92d3ca7af5d8115a28f13212e5ca0c45b9c))
+* **rules:** add optional preconditions to bug report template ([10477d8](https://github.com/mi-examples/qa-ai-rules/commit/10477d8015a99445121027fcc942319d3ed705c2))
+
 # 1.0.0-beta.1 (2026-04-08)
 
 

CLAUDE.md

@@ -1,7 +1,7 @@
 # @metricinsights/qa-ai-rules
 
 Shared QA rules package for AI coding tools across all MI repositories.
-Published to GitHub Packages (`https://npm.pkg.github.com`).
+Published to the public npm registry (`https://registry.npmjs.org/`).
 
 ## Purpose
 
@@ -120,6 +120,22 @@ Consuming repos should use Dependabot to auto-update minor/patch bumps.
 
 ## Publishing
 
+Stable releases are published to [registry.npmjs.org](https://registry.npmjs.org/) by the
+`.github/workflows/release.yml` workflow on `v*` tags, using **npm Trusted Publisher** (OIDC).
+No `NPM_TOKEN` secret is required.
+
+### One-time npm setup (package settings on npmjs.com)
+
+1. Open **@metricinsights/qa-ai-rules** → **Settings** → **Trusted publishing**
+2. Select **GitHub Actions** and configure:
+   - **Organization / user:** `mi-examples`
+   - **Repository:** `qa-ai-rules`
+   - **Workflow filename:** `release.yml` (exact match, including `.yml`)
+3. After a successful OIDC publish, optionally restrict token-based publishing under
+   **Publishing access** → *Require two-factor authentication and disallow tokens*
+
+### Manual publish (local)
+
 ```bash
 npm version minor
 npm publish

README.md

@@ -76,6 +76,22 @@ npm update @metricinsights/qa-ai-rules
 
 Use Dependabot to auto-update minor and patch bumps.
 
+## Publishing
+
+Stable releases go to [registry.npmjs.org](https://www.npmjs.com/package/@metricinsights/qa-ai-rules) when a `v*` tag is pushed. The [Production Release](.github/workflows/release.yml) workflow publishes via **npm Trusted Publisher** (OIDC) — no `NPM_TOKEN` secret.
+
+**One-time setup on npmjs.com** (package **Settings** → **Trusted publishing** → GitHub Actions):
+
+| Field | Value |
+| ----- | ----- |
+| Organization / user | `mi-examples` |
+| Repository | `qa-ai-rules` |
+| Workflow filename | `release.yml` |
+
+After the first successful OIDC publish, you can disable token-based publishing under **Publishing access** and remove the `NPM_TOKEN` repository secret.
+
+Beta pre-releases are created from `develop` via [release-beta.yml](.github/workflows/release-beta.yml) (GitHub pre-release only, not published to npm).
+
 ## License
 
 MIT

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metricinsights/qa-ai-rules",
-  "version": "1.0.0-beta.1",
+  "version": "1.1.0-beta.1",
   "description": "Shared QA rules for AI coding tools (Cursor, Claude Code) across MI repositories",
   "license": "MIT",
   "keywords": [

rules/claude/bug-report-template.md

@@ -0,0 +1,17 @@
+### BUG-XX -- What + Where + When
+**Severity:** Critical / Major / Minor / Low
+**Related TC:** TC-XX
+**Environment:** <URL>
+**User role:** <role>
+
+**Preconditions (optional):** ...
+
+**Steps to reproduce:**
+1. ...
+
+**Expected:** ...
+**Actual:** ...
+
+**Console errors:** `...`
+**Root cause (optional):** file:line references + explanation
+**Screenshot (optional):** `screenshots/<filename>.png`

rules/cursor/bug-report-template.md

@@ -0,0 +1,18 @@
+### BUG-XX -- What + Where + When
+**Severity:** Critical / Major / Minor / Low
+**Related TC:** TC-XX
+**Environment:** <URL>
+**User role:** <role>
+
+**Preconditions (optional):** ...
+
+**Steps to reproduce:**
+1. ...
+
+**Expected:** ...
+**Actual:** ...
+
+**Console errors:** `...`
+**Root cause (optional):** file:line references + explanation
+**Screenshot (optional):** `screenshots/<filename>.png`
+