Merge pull request #27 from consideRatio/pr/yarn-lock

Version control yarn.lock as release automation otherwise errors

.github/workflows/release.yaml

@@ -36,8 +36,10 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
+          cache: yarn
           node-version: "lts/*"
           registry-url: https://registry.npmjs.org
+          cache-dependency-path: yarn.lock
 
       - name: Update root build packages
         run: |

.gitignore

@@ -118,4 +118,3 @@ dmypy.json
 
 # Yarn cache
 .yarn/
-yarn.lock

RELEASE.md

@@ -9,18 +9,33 @@ instructions on how to make a release.
 
 ## Steps to make a release
 
-1. Create a PR updating `CHANGELOG.md` with [github-activity] and continue only
+1. Create a PR updating `yarn.lock` and continue only when its merged.
+
+   This helps us avoid leaving known vulnerabilities are unfixed. To do this,
+   delete the file and manually perform the the `build dist` step in the
+   `.github/workflows/release.yaml` workflow's `build` job as summarized below.
+
+   ```shell
+   # git clean -xfd can be needed to ensure yarn.lock
+   # gets re-created during pyproject-build
+   rm yarn.lock
+
+   pip install --upgrade pip build
+   pyproject-build
+   ```
+
+2. Create a PR updating `CHANGELOG.md` with [github-activity] and continue only
    when its merged.
 
-2. Checkout main and make sure it is up to date.
+3. Checkout main and make sure it is up to date.
 
    ```shell
    git checkout main
    git fetch origin main
    git reset --hard origin/main
    ```
 
-3. Update the version, make commits, and push a git tag with `tbump`.
+4. Update the version, make commits, and push a git tag with `tbump`.
 
    ```shell
    pip install tbump
@@ -32,7 +47,7 @@ instructions on how to make a release.
 
    Following this, the [CI system] will build and publish a release.
 
-4. Reset the version back to dev, e.g. `4.0.1-0.dev` after releasing `4.0.0`.
+5. Reset the version back to dev, e.g. `4.0.1-0.dev` after releasing `4.0.0`.
 
    ```shell
    tbump --no-tag ${NEXT_VERSION}-0.dev