ci: merge release workflows, add npm OIDC provenance

Author: Kiyozz

.github/workflows/create-release-pr.yaml

@@ -5,34 +5,37 @@ on:
     branches:
       - main
 
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
 permissions:
   contents: write
   deployments: write
   id-token: write
+  pull-requests: write
 
 jobs:
   release:
-    if: startsWith(github.head_ref, 'changeset-release')
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v6
+      - uses: actions/checkout@v6
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v4
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: 24
+          registry-url: 'https://registry.npmjs.org'
           cache: 'pnpm'
+          cache-dependency-path: 'pnpm-lock.yaml'
 
-      - name: Install Dependencies
-        run: pnpm install --frozen-lockfile
+      - run: pnpm install --frozen-lockfile
 
-      - name: Publish to npm
-        id: changesets
-        uses: changesets/action@v1
+      - uses: changesets/action@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           publish: pnpm changeset:publish
+          version: pnpm changeset:version
+          commit: 'chore(release): update version for release'
+          title: 'chore(release): update version for release'

.github/workflows/on-release.yaml

@@ -20,7 +20,7 @@
     "lint": "pnpm -r lint",
     "lint:fix": "pnpm -r lint:fix",
     "changeset:version": "changeset version",
-    "changeset:publish": "pnpm -r build && changeset publish"
+    "changeset:publish": "pnpm -r build && changeset publish --provenance"
   },
   "devDependencies": {
     "@changesets/cli": "^2.30.0",