feat(#61): automate npm publish via tag-triggered Trusted Publishing

.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  npm-publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write        # required for OIDC; publish fails without it
+    defaults:
+      run:
+        working-directory: .opencode-plugin
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      # Trusted publishing needs npm >= 11.5.1; setup-node's bundled npm on
+      # Node 22 is 10.x, so upgrade explicitly rather than relying on what
+      # happens to ship with the runner image.
+      - run: npm install -g npm@latest
+      - run: npm ci
+      - name: Check tag matches package version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          pkg=$(node -p "require('./package.json').version")
+          if [ "$tag" != "$pkg" ]; then
+            echo "tag/version mismatch: tag=$tag package.json=$pkg" >&2
+            exit 1
+          fi
+      - run: npm publish

.opencode-plugin/package.json

@@ -17,7 +17,11 @@
     "email": "support@dynamicagency.com"
   },
   "homepage": "https://github.com/dynamic/throughline",
-  "repository": "https://github.com/dynamic/throughline",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dynamic/throughline.git",
+    "directory": ".opencode-plugin"
+  },
   "bugs": "https://github.com/dynamic/throughline/issues",
   "license": "MIT",
   "keywords": [

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to throughline are documented here. Format loosely follows
 
 ## [Unreleased]
 
+### Changed
+- Publishing `@dynamicagency/throughline-opencode` to npm is now automated from a
+  `v*` tag push via npm Trusted Publishing (OIDC) in
+  `.github/workflows/release.yml`, with provenance attestation and no
+  long-lived npm token (issue #61).
+
 ## [0.14.0]
 
 ### Added

README.md

@@ -228,6 +228,11 @@ printed in the injected session-start block (`## throughline vX.Y.Z`) the same w
 it is on Claude Code and Codex - if it lags this repo's releases, your install is
 stale.
 
+Publishing to npm is tag-triggered: pushing a `vX.Y.Z` tag runs a GitHub Actions
+workflow that publishes `@dynamicagency/throughline-opencode` via npm Trusted
+Publishing (OIDC), with no long-lived npm token and an automatic provenance
+attestation on the published package.
+
 **Local-path install (testing unreleased changes).** Point `opencode.json` at a
 checkout of this repo instead of the package name: