Releasing a New Version

Two release tracks are independent — the core library (@vanelsas/baredom) and each framework adapter (@vanelsas/baredom-{react,angular,vue,svelte,solid}) version on their own cadence.

All release-prep commits must land via PR — never push directly to main.

Core library release

When bumping the version, update all four locations — they must match:

1. package.json — "version": "X.Y.Z"
2. build.clj — (def version "X.Y.Z")
3. deps.edn — :exec-args {:artifact "target/baredom-X.Y.Z.jar"}
4. README.md — Clojars and npm install examples

Then:

5. Add a ## [X.Y.Z] entry to CHANGELOG.md
6. Commit, tag vX.Y.Z, push with git push origin main --tags

The release.yml workflow triggers on v* tags and publishes to npm, Clojars, and GitHub Releases. pom.xml is auto-generated by build.clj — do not edit it manually.

Adapter releases

Each framework adapter lives under adapters/<name>/ and has its own workflow in .github/workflows/release-<name>.yml, keyed on <name>-v<X.Y.Z> tags:

Adapter	Workflow	Tag pattern
@vanelsas/baredom-react	release-react.yml	react-vX.Y.Z
@vanelsas/baredom-angular	release-angular.yml	angular-vX.Y.Z
@vanelsas/baredom-vue	release-vue.yml	vue-vX.Y.Z
@vanelsas/baredom-svelte	release-svelte.yml	svelte-vX.Y.Z
@vanelsas/baredom-solid	release-solid.yml	solid-vX.Y.Z

To release an adapter:

1. Bump adapters/<name>/package.json → "version": "X.Y.Z"
2. Commit via PR
3. After merge: git tag <name>-vX.Y.Z && git push origin <name>-vX.Y.Z

The per-adapter workflow regenerates the adapter sources, fails on git diff drift, builds, then npm publish --workspace adapters/<name> --access public with the repo's NPM_TOKEN secret.

First-time publish — NPM_TOKEN permission

The first time an adapter package name is published, the NPM_TOKEN must have permission to create new packages under the @vanelsas scope:

• Automation token (classic) → publishes any package the user owns. No extra config.
• Granular access token → check Permissions → Packages and scopes. Either grant scope-level Read and write on @vanelsas, or add each new package name to the token's allowlist before tagging.

If the first-publish action fails with 403 Forbidden, the token is missing permission for the new name. Fix on npmjs.com, then delete and re-push the failed tag:

git tag -d <name>-vX.Y.Z
git push origin :refs/tags/<name>-vX.Y.Z
# fix token...
git tag <name>-vX.Y.Z && git push origin <name>-vX.Y.Z

EOTP means the token type is wrong (classic non-Automation token blocked by 2FA) — regenerate as Automation or Granular.