ci: npm trusted publishing

.github/workflows/publish.yml

@@ -1,26 +1,62 @@
-name: Publish Package
+name: Release
 
 on:
   push:
+    branches:
+      - master
+      - release
     tags:
       - 'v*'
 
 permissions:
-  id-token: write # Required for OIDC
-  contents: read
+  id-token: write  # Required for OIDC publishing
+  contents: write  # Required for semantic-release to push tags/commits
 
 jobs:
-  publish:
+  release:
+    name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
 
-      - uses: actions/setup-node@v6
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
-          package-manager-cache: false # never use caching in release builds
-      - run: npm ci
-      - run: npm run build --if-present
-      - run: npm test
-      - run: npm publish # Or: npm stage publish
+          cache: yarn
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Build
+        run: yarn build:prod
+
+      - name: Version & Tag
+        if: github.ref_type == 'branch'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BRANCH_NAME: ${{ github.ref_name }}
+        run: yarn run semantic-release
+
+      - name: Publish
+        if: github.ref_type == 'tag'
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          npm version "$VERSION" --no-git-tag-version
+          if [[ "$VERSION" == *"-"* ]]; then
+            DIST_TAG=$(echo "$VERSION" | grep -oP '(?<=-)[a-zA-Z]+')
+            npm publish --provenance --tag "$DIST_TAG"
+          else
+            npm publish --provenance --tag latest
+          fi
+
+      - name: Rebase master
+        if: github.ref_name == 'release' && github.ref_type == 'branch'
+        run: |
+          git checkout master &&
+          git rebase release &&
+          git push origin master

.releaserc.cjs

@@ -46,7 +46,7 @@ const gitSetting = [
 const npmRelease = [
   '@semantic-release/npm',
   {
-    npmPublish: true,
+    npmPublish: false,
   },
 ];
 
@@ -72,6 +72,7 @@ if (process.env && process.env.BRANCH_NAME === 'release') {
     changelogGen,
     releaseNotesGen,
     npmRelease,
+    gitSetting,
   ];
 }