ci: release CLI via semantic-release — no manual tagging

semantic-release + semantic-release-monorepo on push to main, mirroring
theopenco/llmgateway: conventional commits touching the package drive the
version, the tag create-clanker-support@<version> is created by the release,
and publishing stays on npm OIDC trusted publishing (workflow filename
unchanged so the existing trusted publisher keeps matching). Baseline tag
create-clanker-support@1.0.0 marks the already-published release.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: steebchen

.github/workflows/ci.yml

@@ -30,13 +30,18 @@ jobs:
         working-directory: packages/create-clanker-support
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-      - run: npm install --no-package-lock
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+        working-directory: .
       - name: Offline checks
         run: |
-          node index.mjs --version | grep -qx "1.0.0"
+          # The committed version is a placeholder — semantic-release stamps the
+          # real one at publish time — so only assert it prints a semver.
+          node index.mjs --version | grep -Eq "^[0-9]+\.[0-9]+\.[0-9]+$"
           node index.mjs --help | grep -q "create-clanker-support"
           node index.mjs out --template bogus --yes && { echo "expected non-zero"; exit 1; } || true
       - name: Scaffold a real template (fetches from main)

.github/workflows/release-cli.yml

@@ -1,45 +1,46 @@
-# Publishes create-clanker-support to npm. Trigger by pushing a tag:
-#   create-clanker-support@1.0.0
-# Auth is OIDC trusted publishing (no token secret): configure a trusted
-# publisher on the npm package (Settings -> Trusted publisher) pointing at
+# Publishes create-clanker-support to npm via semantic-release on every push to
+# main — no manual tagging. semantic-release-monorepo analyzes conventional
+# commits touching packages/create-clanker-support, computes the next version,
+# tags create-clanker-support@<version>, creates the tag, and publishes.
+# Auth is npm OIDC trusted publishing (no token secret), bound on npmjs.com to
+# THIS filename:
 #   org: theopenco  repo: clankersupport-templates
 #   workflow: release-cli.yml  environment: (none)
-# npm can only add a trusted publisher to an EXISTING package, so the very
-# first publish must be done manually (`npm publish --access public` from
-# packages/create-clanker-support) — every release after that is OIDC.
-# The tag version must match packages/create-clanker-support/package.json —
-# asserted before publish.
+# Renaming this file breaks publishing until the trusted publisher on the npm
+# package settings is updated to match.
 name: Release CLI
 
 on:
   push:
-    tags:
-      - "create-clanker-support@*"
+    branches: [main]
+
+permissions:
+  id-token: write # OIDC token for npm trusted publishing
+  contents: write # semantic-release pushes the release tag
+  issues: write
+  pull-requests: write
 
 jobs:
   publish:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write # OIDC token for npm trusted publishing
-    defaults:
-      run:
-        working-directory: packages/create-clanker-support
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          # Node 24 bundles npm >= 11.5.1, required for trusted publishing.
+          node-version: 24
+          cache: pnpm
           registry-url: https://registry.npmjs.org
-      # Node 22 bundles npm 10; trusted publishing needs npm >= 11.5.1.
-      - run: npm install -g npm@11
-      - name: Assert tag matches package version
-        run: |
-          TAG_VERSION="${GITHUB_REF_NAME#create-clanker-support@}"
-          PKG_VERSION="$(node -p "require('./package.json').version")"
-          test "$TAG_VERSION" = "$PKG_VERSION" || { echo "tag $TAG_VERSION != package.json $PKG_VERSION"; exit 1; }
-      - run: npm install --no-package-lock
+      - run: pnpm install --frozen-lockfile
       - name: Smoke test
+        working-directory: packages/create-clanker-support
         run: node index.mjs --help | grep -q "create-clanker-support"
-      - name: Publish
-        run: npm publish --access public
+      - name: Semantic Release
+        working-directory: packages/create-clanker-support
+        run: pnpm semantic-release
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

.husky/commit-msg

@@ -0,0 +1 @@
+pnpm commitlint --edit $1

package.json

@@ -8,7 +8,19 @@
 	},
 	"packageManager": "pnpm@10.0.0",
 	"scripts": {
-		"build": "pnpm -r build"
+		"build": "pnpm -r build",
+		"postinstall": "husky"
+	},
+	"commitlint": {
+		"extends": "@steebchen/commitlint-config"
+	},
+	"devDependencies": {
+		"@semantic-release/exec": "^7.1.0",
+		"@steebchen/commitlint-config": "^1.7.0",
+		"commitlint": "21.0.1",
+		"husky": "^9.1.7",
+		"semantic-release": "^24.2.5",
+		"semantic-release-monorepo": "8.0.2"
 	},
 	"pnpm": {
 		"onlyBuiltDependencies": [

packages/create-clanker-support/.releaserc.json

@@ -0,0 +1,16 @@
+{
+	"branches": ["main"],
+	"tagFormat": "create-clanker-support@${version}",
+	"extends": "semantic-release-monorepo",
+	"plugins": [
+		"@semantic-release/commit-analyzer",
+		"@semantic-release/release-notes-generator",
+		[
+			"@semantic-release/exec",
+			{
+				"prepareCmd": "npm pkg set version=${nextRelease.version}",
+				"publishCmd": "npm publish --provenance --access public"
+			}
+		]
+	]
+}