release.yml

name: Release

# Publishes to npm via Trusted Publishing (OIDC), no long-lived tokens.
# The package's Trusted Publisher on npm points at this repo + workflow,
# which is what the id-token: write permission below binds to.
# https://docs.npmjs.com/trusted-publishers/
# https://docs.npmjs.com/generating-provenance-statements
#
# Triggered when a v* tag is pushed:
#   git tag v0.1.1 && git push --tags

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: write        # for creating the GitHub Release
  id-token: write        # for npm OIDC (provenance + trusted publishing)

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          cache: npm

      # Trusted Publishing requires npm >= 11.5.1. Node 24 ships with npm 11.x,
      # but pin to the latest explicitly so a runner image change never breaks
      # publishes.
      - name: Ensure npm >= 11.5.1 for Trusted Publishing
        run: npm install -g npm@latest

      - run: npm ci
      - run: npm test
      - run: npm run build

      - name: Publish to npm (OIDC, provenance)
        run: npm publish --provenance --access public

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true