From 74720f4c16ce5ba6dc7f68656466fa39b20af21b Mon Sep 17 00:00:00 2001
From: NikolaiKushner <nickolaikushner@gmail.com>
Date: Sat, 1 Aug 2026 23:31:03 +0400
Subject: [PATCH] ci: add the release workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Trusted publishing over OIDC, so there is no npm token anywhere. While
unreleased changesets exist the action maintains a "Version Packages" PR;
merging it triggers the run that publishes, which keeps a release a
deliberate merge rather than a push.

Build before lint, typecheck and test, as ci.yml already does — the
workspace packages resolve through dist and the other steps fail
confusingly against an unbuilt tree.

Fail the release if the generated docs have drifted. AGENTS.md ships inside
the package, so a stale copy would be published as the API reference.
---
 .github/workflows/release.yml | 59 +++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..8959009
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,59 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+# One release at a time. Two overlapping runs would race on the version bump.
+concurrency: release-${{ github.ref }}
+
+permissions:
+  contents: write # changesets commits version bumps and pushes tags
+  pull-requests: write # changesets opens and updates the "Version Packages" PR
+  id-token: write # OIDC — this is what replaces a long-lived npm token
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # Changesets needs the history to work out what has already shipped.
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@v6
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      # Trusted publishing needs npm 11.5.1+; the runner's bundled npm is older.
+      - run: npm install -g npm@latest
+
+      - run: pnpm install --frozen-lockfile
+
+      # Build first: the workspace packages resolve through dist, so lint,
+      # typecheck and test all fail confusingly against an unbuilt tree.
+      - run: pnpm build
+      - run: pnpm lint
+      - run: pnpm typecheck
+      - run: pnpm test
+      - run: pnpm size
+
+      # Generated files are generated. If either has drifted the release would
+      # ship documentation that disagrees with the code it describes.
+      - run: pnpm docs:props && pnpm docs:agents
+      - name: Fail if generated docs are stale
+        run: git diff --exit-code || (echo "::error::Run pnpm docs:props and pnpm docs:agents, then commit" && exit 1)
+
+      - name: Create release PR or publish
+        uses: changesets/action@v1
+        with:
+          # While unreleased changesets exist this opens or updates the
+          # "Version Packages" PR. Merging that PR triggers the run that
+          # actually publishes, so a release is always a deliberate merge.
+          publish: pnpm changeset publish
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}