[Yukaii]

This PR adds two workflows:

• .github/workflows/publish.yml publishes @hackmd/markdown-it to npm through npm trusted publishing (OIDC). It uses no npm token, and every publish gets provenance.
• .github/workflows/bump-version.yml bumps the version, rebuilds dist/, commits and tags on master, creates the GitHub Release, and dispatches publish.yml.

Agent: Cursor cloud agent (on behalf of Yukaii)

publish.yml

• Triggers: release: published (a person publishing a Release) and workflow_dispatch (used by the bump workflow, or a manual re-run with optional dry-run).
• Permissions: id-token: write, contents: read.
• Environment: npm, used as an approval gate.
• Toolchain: Node 24, with npm upgraded to 11.x if it's older than 11.5.1.
• Guards: the tag must match package.json's version, that version must not already be on npm, and a manual run must come from a tag or master.
• Steps: npm ci, npm test, npm run build, then npm publish --access public --provenance. Pre-release versions are published under next.

bump-version.yml

• Trigger: workflow_dispatch on master.
• Inputs: release-type (patch, minor, major or prerelease), optional explicit version, preid (default beta), and dry-run.
• Steps:
  1. npm version --no-git-tag-version updates package.json and package-lock.json.
  2. The run refuses if the tag already exists or the version is already on npm.
  3. Test and rebuild dist/.
  4. Commit chore: release <version> [skip ci], including dist/. This replaces the manual "chore: build" commit.
  5. Tag v<version> and push the commit and tag in one atomic push.
  6. gh release create --generate-notes.
  7. gh workflow run publish.yml --ref v<version>.
• Changelog: the release flow doesn't touch CHANGELOG.md.

Design notes

• GITHUB_TOKEN events: pushes, tags and releases made with GITHUB_TOKEN don't start workflows, but workflow_dispatch does. That's why the bump workflow dispatches publish explicitly.
• [skip ci]: it only affects push and pull_request events. publish.yml has no push trigger, so the skip can't reach it.
• Why not workflow_call: with workflow_call, npm would validate the caller's filename. A dispatched run of publish.yml is its own top-level run, so the registered filename stays publish.yml.
• Branch protection: master currently has no classic protection, and the only rule is the org's Copilot code review rule, which doesn't block pushes. If master later requires PRs or status checks, the bot push will need a GitHub App token that's on the ruleset's bypass list.

Other changes

• package.json: repository now uses the full GitHub URL. Trusted publishing requires repository.url to match the repository.
• Short RELEASING.md, plus a one-line link to it from CONTRIBUTING.md.

Flaky pathological tests (pre-existing, from #22)

Push CI on 77a6dc4 and d5878aa failed with Terminated (timeout exceeded). The failing tests were "many code spans on one line" and "many images on one line", which 240d144 added in #22.

• Cause: both tests rendered 300k repeats under a 3-second limit that includes worker startup. Healthy code took 1.8 to 2.8 s on CI; master's run after fix: accurate source positions in containers and code blocks #22 took 2.6 s. Slow runners therefore timed out.
• The guard was also weak: the quadratic code from before 240d144 rendered the code-span input in 2.4 s on a fast machine, which passed.
• Not caused by this PR: it changes no code these tests exercise.
• Not the CRC check: that test is skipped outside scheduled CI.

test_linear now compares the time for n and 4n repeats in the same worker, best of 2, with a 30-second hang timeout. Results:

• Current code: about 3.6 to 4.2x when timed directly on Node 24. The tests pass on Node 18 and 24, including with every CPU core busy.
• Pre-fix lib/: 7.3 to 8.6x, so it fails the 6x limit every time.
• CI on 71e567c: both runs pass. The push run's images test took 4.8 s in total, which would have exceeded the old limit.

Testing

• actionlint passes.
• npm test passes on Node 18 and 24.
• I ran the bump script in a scratch clone with no push:
  • Version 14.2.0 and minor both give 14.2.0, and prerelease gives 14.1.3-beta.0.
  • An existing tag (12.0.12) and an unchanged version (14.1.2) are rejected.
  • The commit contains only dist/, package.json and package-lock.json.

npm Trusted Publisher values

Field	Value
Organization or user	hackmdio
Repository	markdown-it
Workflow filename	publish.yml
Environment name	npm
Allowed actions	tick npm publish

No version bump, tags, releases, publishes or workflow runs.

  

[coveralls]

Coverage Report for CI Build 39545612036

Coverage remained the same at 99.336%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	6667
Covered Lines:	6634
Line Coverage:	99.51%
Relevant Branches:	1764
Covered Branches:	1741
Branch Coverage:	98.7%
Branches in Coverage %:	Yes
Coverage Strength:	391289.11 hits per line

---

💛 - Coveralls