release.yml

name: Release

# Publish to npm via OIDC trusted publishing when a version tag is pushed:
#   npm version patch && git push --follow-tags
#
# Trusted Publisher is configured on npmjs.com (org pifydev, repo cli,
# workflow release.yml) with the strict 2FA option, so no NPM_TOKEN is used:
# npm authenticates via the id-token permission and attaches provenance
# automatically.
on:
  push:
    tags: ["v*"]

permissions: {}

jobs:
  publish:
    runs-on: ubuntu-latest # trusted publishing requires GitHub-hosted runners
    permissions:
      contents: read
      id-token: write # npm OIDC trusted publishing / automatic provenance
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org
      - run: npm install -g npm@latest # trusted publishing needs npm >= 11.5.1
      - run: npm ci
      - run: npm run typecheck
      - run: npm run build
      - run: npm test
      - run: npm publish # OIDC; no NPM_TOKEN, no --provenance flag