[tyler-reitz]

Closes #848, taking the suggestion there: a release guide an agent or maintainer can follow, instead of another CI pipeline.

What changed

.github/CONTRIBUTING.md gets a "Publishing a release (maintainers)" section with five steps: confirm main is green, bump the version, smoke-test the bump commit's -exp build in a Vite app and a Next.js App Router app, publish a GitHub release, verify.

Verification

The smoke test in step 3 was run as written, against production builds in headless Chromium:

Version	Vite	Next.js
4.2.4 (#759)	Fails: Calling `require` for "react" in an environment that doesn't expose the `require` function	Fails: build stops prerendering / (dynamic usage of require is not supported)
4.3.0	Renders, clean console	Renders, clean console
4.3.0-exp.d47dad5 (current main)	Renders, clean console	Renders, clean console

Caveats

• It informs a release; it does not gate one. Nothing stops a tag without it.
• The guide describes the flow test.yaml and build.sh implement today. The 4.3.0 release run published from CI.

[jhuleatt]

Looks good, approving so you aren't blocked. A few things from cutting 4.3.0 worth folding in if you want:

1. In step 2, main requires an approved PR (enforce_admins is off), so only repo admins can commit and push the version bump directly to main. Non-admin maintainers need to land the bump through a PR. Might also be worth showing the git commit and git push after npm version --no-git-tag-version.
2. In step 3, since reactfire@<exp version> is already installed in a scratch folder, a quick one-liner can also cover bare Node ESM (#846), CJS require('reactfire'), and the baked-in version string:

   node -e "import('reactfire').then(m => console.log('ESM:', m.version)); console.log('CJS:', require('reactfire').version)"

3. In step 4, targeting the bump commit SHA instead of main avoids tagging a newer commit if Dependabot or another PR merges while step 3 is running.
4. Also in step 4, GitHub's auto-generated release notes pull in dozens of Dependabot bumps from /example, /functions, and devDependencies that don't ship in the package. For 4.3.0 we stripped those out by hand, so it's worth mentioning here (or excluding dependabot[bot] via .github/release.yml in a follow-up).