feat(release): set up automated semantic-release via OIDC #15

	name: Publish to npm

	on:
	push:
	branches:
	- main
	workflow_dispatch:

	jobs:
	release:
	runs-on: ubuntu-latest
	permissions:
	contents: write # needed to create the GitHub Release and push commits/tags
	id-token: write # for npm provenance and Trusted Publishing OIDC
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0 # full history is required for semantic-release to analyze commits

	# Trusted Publishing (OIDC) requires npm >= 11.5.1. Node 24 ships
	# with npm 11 by default. We do NOT specify "registry-url" because
	# doing so conflicts with npm's default OIDC authentication mechanism.
	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: 24
	cache: npm

	- name: Install dependencies
	run: npm ci

	- name: Typecheck
	run: npm run typecheck

	# Runs semantic-release. Omitting NPM_TOKEN triggers the @semantic-release/npm
	# plugin to use OIDC Trusted Publishing.
	- name: Run semantic-release
	run: npx semantic-release
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Navigation Menu