Add trusted publishing workflows

Author: RouterBase Contributors

.github/workflows/publish-ghcr.yml

@@ -0,0 +1,33 @@
+name: Publish GHCR
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: ghcr.io/routerbase/routerbase-prompt-runner
+          tags: |
+            type=raw,value=latest
+            type=sha
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: examples/docker/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/publish-jsr.yml

@@ -0,0 +1,21 @@
+name: Publish JSR
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: packages/jsr-routerbase
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - run: npx jsr publish

.github/workflows/publish-pypi.yml

@@ -0,0 +1,25 @@
+name: Publish PyPI
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: packages/python-routerbase
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python -m pip install --upgrade build
+      - run: python -m build
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: packages/python-routerbase/dist

docs/batch-plan.md

@@ -28,6 +28,11 @@ Content goals:
 - Model listing helper.
 - Deno and modern TypeScript usage examples.
 
+Status:
+
+- Local dry run passes.
+- Manual GitHub Actions workflow added: `.github/workflows/publish-jsr.yml`.
+
 ## Batch 3 - PyPI
 
 Publish the Python package from `packages/python-routerbase`.
@@ -42,6 +47,12 @@ Content goals:
 - CLI entry point.
 - Project URLs that point to RouterBase docs and GitHub.
 
+Status:
+
+- Wheel and sdist build locally.
+- `twine check` passes.
+- Manual GitHub Actions workflow added: `.github/workflows/publish-pypi.yml`.
+
 ## Batch 4 - Docker
 
 Publish a small prompt runner image to Docker Hub or GitHub Container Registry.
@@ -57,6 +68,11 @@ Content goals:
 - One command prompt execution.
 - Link back to RouterBase docs.
 
+Status:
+
+- Dockerfile added.
+- Manual GitHub Actions workflow added: `.github/workflows/publish-ghcr.yml`.
+
 ## Batch 5 - Language SDKs
 
 Add one SDK at a time only when it has real tests and examples:

docs/trusted-publishing.md

@@ -0,0 +1,84 @@
+# Trusted Publishing Setup
+
+The repository includes manual workflows for JSR, PyPI, and GitHub Container Registry. They are designed to publish real packages without storing long-lived platform tokens in GitHub secrets.
+
+## JSR
+
+Workflow:
+
+```text
+.github/workflows/publish-jsr.yml
+```
+
+Package:
+
+```text
+packages/jsr-routerbase
+```
+
+Before running:
+
+- Create or claim the `@routerbase` scope on JSR.
+- Configure trusted publishing for `RouterBase/routerbase-examples`.
+- Set the package path to `packages/jsr-routerbase`.
+- Run the workflow manually from GitHub Actions.
+
+Local verification:
+
+```bash
+cd packages/jsr-routerbase
+npx jsr publish --dry-run
+```
+
+## PyPI
+
+Workflow:
+
+```text
+.github/workflows/publish-pypi.yml
+```
+
+Package:
+
+```text
+packages/python-routerbase
+```
+
+Before running:
+
+- Create the `routerbase-client` project on PyPI through the first trusted publish.
+- Configure PyPI trusted publishing for `RouterBase/routerbase-examples`.
+- Use workflow name `Publish PyPI`.
+- Use package directory `packages/python-routerbase`.
+
+Local verification:
+
+```bash
+cd packages/python-routerbase
+python -m build
+python -m twine check dist/*
+```
+
+## GitHub Container Registry
+
+Workflow:
+
+```text
+.github/workflows/publish-ghcr.yml
+```
+
+Image:
+
+```text
+ghcr.io/routerbase/routerbase-prompt-runner
+```
+
+Before running:
+
+- Confirm the repository has package write permission.
+- Run the workflow manually from GitHub Actions.
+- After the first push, make the package public in GitHub Packages if needed.
+
+## Link Policy
+
+Keep links natural and developer-focused. The first README link uses `[RouterBase](https://routerbase.com)`, and package metadata points to the RouterBase homepage.