.gitea/workflows/build.yaml

@@ -6,7 +6,8 @@ on:
   push:
 jobs:
   node:
-    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/node.yaml@v1
+    # @main until the owner moves ci-workflows v1 onto the publishing node.yaml; then back to @v1.
+    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/node.yaml@main
     with:
       node-version: '24'
       install: npm ci --ignore-scripts
@@ -21,3 +22,8 @@ jobs:
         npm run lint
         npm run check
         npm run bundle
+      # A v<package.json version> tag creates the Gitea release with the bundle, SHA256SUMS and the
+      # CHANGELOG section (-rc.N -> prerelease). The package is private: nothing goes to npm.
+      publish: true
+      npm-publish-dirs: ''
+      release-files: dist/*

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.1.1-rc.1
+
+Release-pipeline candidate: no schema, fixture or wire change from 1.1.0. The
+first release built and published by Gitea CI from the tag (bundle, `SHA256SUMS`
+and these notes), replacing the hand-published Gitea release and the retired
+GitHub release with attestation.
+
 ## 1.1.0
 
 Additive contract for printing semantic extension **2.4.0**. Wire payload stays

CONTRIBUTING.md

@@ -8,7 +8,7 @@ Run both the Java and .NET consumers' protocol tests for a contract change. Chec
 
 Keep wire-v1 payload names stable for native `/qqq/v1/qbit/printing` and explicit legacy `/printing/v1` routes. Optional response fields may be added; clients ignore unknown response fields. Removing/renaming a field, changing its type or changing an existing field's meaning requires explicit versioned compatibility design. Package, printing extension, wire and WebSocket subprotocol versions are independent; see [the version registry](docs/VERSIONS.md). A package version is not permission to silently break an already deployed connector.
 
-`npm run bundle` produces the release archive and checksum in `dist/`. Do not hand-edit generated checksums. Release tags must match the version in package.json, prefixed with `v`. Maintainers publish reviewed artifacts on [Gitea releases](https://git.kof22.com/QRun-IO/qqq-print-protocol/releases). GitHub Actions for this repository were retired on 2026-11-04; retained `.github/scripts` remain local/shared-CI tooling. See [current release provenance](docs/INTEGRATION.md#stable-printing-release) before updating consumer fixture pins.
+`npm run bundle` produces the release archive and checksum in `dist/`. Do not hand-edit generated checksums. Release tags must match the version in package.json, prefixed with `v`. A `v<version>` tag on the reviewed merge commit makes Gitea CI rerun every check, build the bundle and create the [Gitea release](https://git.kof22.com/QRun-IO/qqq-print-protocol/releases) with the archive, a fresh `SHA256SUMS` (the bundle's own is checked first) and the matching CHANGELOG section as notes (a `-rc.N` version is a prerelease). Gitea has no equivalent of the retired GitHub artifact attestation: verify downloads against `SHA256SUMS` and the tag. GitHub Actions for this repository were retired on 2026-11-04; retained `.github/scripts` remain local/shared-CI tooling. See [current release provenance](docs/INTEGRATION.md#stable-printing-release) before updating consumer fixture pins.
 
 ## Script quality
 

docs/INTEGRATION.md

@@ -102,4 +102,4 @@ npm run bundle
 
 The check runs full draft-2020-12 schema compilation and fixture validation with Ajv, plus independent content/hash/base64 and invalid-input checks. `node tools/verify-fixtures.mjs` remains available without installing dependencies for a quick subset check.
 
-The bundle includes specification, schema, fixtures, tools, dependency manifests and lockfile, and license metadata, excluding installed dependencies. Consumers do not need Node.js to use the schema or fixture JSON. Maintainers publish the bundle and checksum on [Gitea releases](https://git.kof22.com/QRun-IO/qqq-print-protocol/releases); no npm registry publication is performed. Protocol GitHub Actions were retired on 2026-11-04; retained files and historical results do not imply a new hosted build or attestation.
+The bundle includes specification, schema, fixtures, tools, dependency manifests and lockfile, and license metadata, excluding installed dependencies. Consumers do not need Node.js to use the schema or fixture JSON. Gitea CI publishes the bundle and checksum on [Gitea releases](https://git.kof22.com/QRun-IO/qqq-print-protocol/releases) from a `v<version>` tag; no npm registry publication is performed and there is no artifact attestation (Gitea has no equivalent). Protocol GitHub Actions were retired on 2026-11-04; retained files and historical results do not imply a new hosted build or attestation.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@qrun-io/qqq-print-protocol",
-  "version": "1.1.0",
+  "version": "1.1.1-rc.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@qrun-io/qqq-print-protocol",
-      "version": "1.1.0",
+      "version": "1.1.1-rc.1",
       "license": "Apache-2.0",
       "devDependencies": {
         "@eslint/js": "10.0.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qrun-io/qqq-print-protocol",
-  "version": "1.1.0",
+  "version": "1.1.1-rc.1",
   "private": true,
   "description": "Versioned wire contract and compatibility fixtures for QQQ cloud printing.",
   "license": "Apache-2.0",