0.3.1 #7

	name: Publish to npm

	# Publishes ONLY when you push a version tag, e.g.:
	# npm version 0.1.0 # bumps package.json + creates the v0.1.0 commit/tag
	# git push --follow-tags
	# A bare push to main never publishes (that's what CI is for). npm versions are
	# immutable, so the tag IS the release — re-tagging an existing version fails.
	on:
	push:
	tags:
	- "v*"

	jobs:
	publish:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	id-token: write # required for npm Trusted Publishing (OIDC) — no stored token
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: 22
	registry-url: https://registry.npmjs.org

	# Trusted Publishing needs a recent npm; the runner's bundled npm may be
	# older than the 11.5.1 minimum, so upgrade it explicitly.
	- run: npm install -g npm@latest

	- run: npm ci
	- run: npm test

	# Guard: the git tag must match the package.json version, so v0.1.0 can't
	# accidentally publish a package.json that still says 0.0.0.
	- name: Verify tag matches package.json version
	run: \|
	PKG=$(node -p "require('./package.json').version")
	TAG=${GITHUB_REF_NAME#v}
	if [ "$PKG" != "$TAG" ]; then
	echo "::error::tag v$TAG does not match package.json version $PKG"
	exit 1
	fi
	echo "Publishing version $PKG"

	# OIDC: no NODE_AUTH_TOKEN / NPM_TOKEN needed. npm exchanges the GitHub
	# OIDC token for short-lived publish credentials, and records provenance.
	- run: npm publish --provenance --access public

Provide feedback