Add npm publishing metadata and release workflow (#3)

* Add npm publishing metadata and release workflow

- Fill in package.json author/repository/bugs/homepage so the
  published tarball links back to the repo for discovery and
  issue filing.
- Add .github/workflows/release.yml that publishes to npm on
  v* tag push with provenance. Verifies the tag matches
  package.json version before publishing; requires NPM_TOKEN
  in Actions secrets.
- Update CONTRIBUTING.md release section to describe the
  workflow instead of the "run npm publish manually" stopgap.

* Add npm run release script for bump-and-push flow

npm run release -- <patch|minor|major> runs typecheck + tests via
the preversion hook, then npm version bumps package.json and tags,
then postversion does git push --follow-tags so the commit and tag
land together. That tag push is what triggers the release workflow
to publish to npm.

Author: bigtiger

.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - run: npm ci
+
+      - run: npm run typecheck
+
+      - run: npm test
+
+      - run: npm run build
+
+      - name: Verify tag matches package.json version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          pkg="$(node -p "require('./package.json').version")"
+          if [ "$tag" != "$pkg" ]; then
+            echo "Tag $GITHUB_REF_NAME ($tag) does not match package.json version $pkg" >&2
+            exit 1
+          fi
+
+      - run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

CONTRIBUTING.md

@@ -112,13 +112,15 @@ Out of scope without an ADR:
 
 ## Releasing (maintainers)
 
-1. Bump `package.json` version.
-2. Update `CHANGELOG.md` with the new section.
-3. `git commit -m "Release vX.Y.Z"`
-4. `git tag vX.Y.Z && git push --tags`
-5. The `release.yml` workflow publishes to npm on tag push and
-   creates the GitHub release. (Until that workflow lands, run
-   `npm publish` manually.)
+1. Update `CHANGELOG.md` with the new section and commit it.
+2. `npm run release -- <patch|minor|major>` (or an explicit version
+   like `0.2.0`). This runs typecheck + tests, bumps
+   `package.json`, creates the `vX.Y.Z` commit and tag, and pushes
+   both with `git push --follow-tags`.
+3. The `release.yml` workflow publishes to npm on tag push.
+   Requires `NPM_TOKEN` in the repo's GitHub Actions secrets; the
+   workflow also verifies the tag matches `package.json` before
+   publishing with provenance.
 
 ## Code of conduct
 

package.json

@@ -20,7 +20,10 @@
     "typecheck": "tsc --noEmit",
     "test": "node --import tsx --test 'test/**/*.test.ts'",
     "test:watch": "node --import tsx --test --watch 'test/**/*.test.ts'",
-    "prepublishOnly": "npm run typecheck && npm test && npm run build"
+    "prepublishOnly": "npm run typecheck && npm test && npm run build",
+    "preversion": "npm run typecheck && npm test",
+    "postversion": "git push --follow-tags",
+    "release": "npm version"
   },
   "dependencies": {
     "commander": "^12.1.0"
@@ -32,5 +35,14 @@
     "undici": "^6.20.0"
   },
   "keywords": ["userback", "cli", "feedback"],
-  "license": "MIT"
+  "license": "MIT",
+  "author": "Jim Remsik <jim@beflagrant.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/beflagrant/userback-cli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/beflagrant/userback-cli/issues"
+  },
+  "homepage": "https://github.com/beflagrant/userback-cli#readme"
 }