build: tagged releases with npm version

.github/workflows/release.yml

@@ -0,0 +1,25 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*.*.*']
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check tag matches package.json
+        run: |
+          version="v$(node -p 'require("./package.json").version')"
+          if [ "$version" != "$GITHUB_REF_NAME" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match package.json ($version)" >&2
+            exit 1
+          fi
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "$GITHUB_REF_NAME" --verify-tag --generate-notes

.npmrc

@@ -0,0 +1 @@
+message="chore(release): v%s"

README.md

@@ -64,3 +64,15 @@ Questions about the SFU itself belong in
 
 The code is [MIT](LICENSE) © Mathieu Chambaud. The Lumyx name, logo and the assets in
 [`brand/`](brand) are not covered by the MIT license and may not be used to imply endorsement.
+
+## Releasing
+
+Versions follow [SemVer](https://semver.org/) and are cut from an up-to-date `main`:
+
+```sh
+npm version patch   # or minor / major
+```
+
+This runs the CI checks, bumps `package.json`, commits `chore(release): vX.Y.Z`, tags `vX.Y.Z`
+and pushes. The tag triggers the Release workflow, which publishes a GitHub release with
+generated notes.

package.json

@@ -17,7 +17,9 @@
     "lint": "turbo run lint",
     "check-types": "turbo run check-types",
     "test": "turbo run test",
-    "verify:ds": "turbo run verify:ds"
+    "verify:ds": "turbo run verify:ds",
+    "preversion": "test \"$(git branch --show-current)\" = main && git fetch -q origin main && test \"$(git rev-parse HEAD)\" = \"$(git rev-parse origin/main)\" && bun run lint && bun run check-types && bun run test && bun run verify:ds && bun run build",
+    "postversion": "git push --follow-tags"
   },
   "devDependencies": {
     "turbo": "^2.10.12",