release.yml

name: Release
on:
  push: { branches: [main] }
permissions: { contents: write, pull-requests: write, id-token: write }
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      # Node 22.14+ and npm 11.5.1+ are required for npm OIDC trusted publishing.
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: pnpm }
      - run: npm install -g npm@latest # ensure npm >= 11.5.1 for OIDC
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      # No NPM_TOKEN: auth is the GitHub OIDC token (id-token: write) + the per-package
      # Trusted Publisher configured on npmjs.com. Provenance stays on via .npmrc.
      - uses: changesets/action@v1
        with: { publish: pnpm release }
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}