[AndreyKozhevnikov]

Documentation repos use these styles by copying the vale/ folder. That gives them no version to pin and no way to tell whether new rules will break their Vale check. This PR publishes the styles to GitHub Packages as @devexpress/vale-styles so that consumers can pin a version and upgrade when they choose. The rules and the vale/ folder are unchanged. The only addition under vale/ is a new test sample.

Changes

• package.json: adds the package @devexpress/vale-styles@1.0.0, which publishes to https://npm.pkg.github.com. files ships only dist/ and THIRD_PARTY_NOTICES.md.
  • The build, prepack and test scripts call vale-style-package-publisher, from the internal @devexpress/vale-style-package-publisher package (pinned to 1.0.0). This keeps custom build code out of this public repo.
  • The built dist/DevExpress/ is a Vale package: styles/, plus .vale.ini without its StylesPath line. dist/templates/ holds junit.tmpl and rdjsonl.tmpl. Consumers set Packages = node_modules/@devexpress/vale-styles/dist/DevExpress and run vale sync.
• Vale pin: @vvago/vale is pinned exactly to 3.25.1 in devDependencies. It is also declared as an optional peer dependency (~3.25.1), so npm checks the version for consumers who install Vale from npm, and consumers who don't are not given a second binary. allowScripts approves the wrapper's postinstall, which downloads the Vale binary.
• .github/workflows/ci.yml: runs npm test with a read-only token on pull requests and on pushes to main. npm test builds dist/ and syncs it into a temporary consumer project. It fails if any of the following happens:

  • Vale exits with code 2.

  • The merged config lacks DX, Microsoft or Vocab = DX.

  • clean.md has alerts.

  • A fixture's own rule never fires.

  • The npm pack file list changes.

• .github/workflows/release.yml: runs on vX.Y.Z tags.
  • The test job runs npm ci and npm test with a read-only token.
  • The publish job (contents: write, packages: write) runs npm ci --ignore-scripts, then check-release, npm publish and gh release create.
  • A stable tag must be in the first-parent history of main and must not be lower than latest.
  • A vX.Y.Z-rc.N tag on any commit publishes under the next dist-tag as a GitHub prerelease.
• CHANGELOG.md: adds the version policy (major = new alerts are possible on unchanged text, minor = additions only, patch = false-positive fixes and message changes) and the 1.0.0 entry. The release workflow uses the version's section as the release notes and fails if that section is missing.
• vale/vale/tests/clean.md: a sample that must produce zero alerts.
• .gitignore: ignores node_modules/ and dist/.

Worth a careful look

• Release job security: the publish job runs no third-party code alongside the write token. --ignore-scripts means the Vale binary is never downloaded, and the only tool that runs is the dependency-free publisher. Every checkout uses persist-credentials: false.
• Access to the internal package: CI's npm ci reads @devexpress/vale-style-package-publisher with GITHUB_TOKEN. This only works while that package lists this repo under Manage Actions access.
• Local setup: npm ci now needs a GitHub Packages token with read:packages. Your user-level npm config must also map @devexpress to https://npm.pkg.github.com, because the repo has no .npmrc.
• After merge: a maintainer tags v1.0.0 on the merge commit, which publishes the package.

Testing

CI runs npm test on this PR.