ci: CI, a load test and npm trusted publishing (OIDC); release 1.2.1 [PRV-7340]

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  # Actions are pinned to commit SHAs; this keeps the pins current.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    # Wait a week after a release: a hijacked action version is usually caught and pulled by then.
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '**'
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: CI
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [18.x, 20.x, 22.x, 24.x]
+
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        name: Checkout
+        with:
+          persist-credentials: false
+
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test
+
+  zizmor:
+    name: Workflow security (zizmor)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
+
+      - uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        with:
+          advanced-security: false

.github/workflows/publish.yml

@@ -0,0 +1,63 @@
+name: Publish
+
+on:
+  release:
+    types: [ published ]
+  workflow_dispatch:
+
+permissions: {}
+
+env:
+  # Trusted publishing needs npm >= 11.5.1, which ships with Node 24.
+  NODE_VERSION: 24.x
+  REGISTRY: https://registry.npmjs.org/
+
+jobs:
+  test:
+    name: Run tests before publish
+    uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
+
+  publish_version:
+    name: Publish
+    runs-on: ubuntu-latest
+    needs: [ test ]
+    # A pre-release must never become the stable `latest` version on npm.
+    if: github.event_name != 'release' || !github.event.release.prerelease
+    permissions:
+      id-token: write # OIDC token for npm trusted publishing
+      contents: read
+    steps:
+
+      - name: Checkout
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
+
+      - name: Use Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          registry-url: ${{ env.REGISTRY }}
+          # No cache in the job that publishes: a poisoned cache entry would ship in the package.
+          package-manager-cache: false
+
+      - name: Install dependencies
+        run: npm ci
+
+      # npm never lets a published version be reused, so a tag/manifest mismatch must fail before publishing.
+      - name: Check the release tag matches package.json
+        if: github.event_name == 'release'
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          if [ "${TAG#v}" != "$VERSION" ]; then
+            echo "::error::Release tag $TAG does not match package.json version $VERSION"
+            exit 1
+          fi
+
+      - name: Publish
+        run: |
+          npm publish

.github/zizmor.yml

@@ -0,0 +1,4 @@
+rules:
+  # Calls to this repo's own reusable workflow use `./`; zizmor suggests a newer `$/` syntax.
+  self-repository:
+    disable: true