chore: rework publish #445

	name: ci

	on: [push, pull_request]

	jobs:
	deno:
	if: \|
	github.event_name == 'push' \|\|
	!startsWith(github.event.pull_request.head.label, 'denoland:')
	runs-on: ubuntu-latest
	timeout-minutes: 30

	steps:
	- uses: actions/checkout@v4
	with:
	submodules: true

	- uses: denoland/setup-deno@v2
	with:
	# Pinned to avoid TLS panic in `deno sandbox copy/extend` (regression
	# present in at least v2.7.13 and v2.7.14; v2.7.8 is the last version
	# confirmed working). See https://github.com/denoland/deno/issues/33713
	# — unpin once fixed upstream.
	deno-version: v2.7.8

	- name: fmt
	run: deno fmt --check

	- name: build
	run: deno task build

	- name: lint
	run: deno lint

	- name: check
	run: deno check

	- name: run tests
	env:
	DENO_DEPLOY_TOKEN: ${{ secrets.DENO_DEPLOY_TOKEN }}
	DENO_DEPLOY_CLI_SPECIFIER: file://${{ github.workspace }}/main.ts
	run: deno test --allow-all

	jsr:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	id-token: write
	steps:
	- uses: actions/checkout@v4
	with:
	submodules: true
	- uses: denoland/setup-deno@v2
	with:
	# Pinned to avoid TLS panic in `deno sandbox copy/extend` (regression
	# present in at least v2.7.13 and v2.7.14; v2.7.8 is the last version
	# confirmed working). See https://github.com/denoland/deno/issues/33713
	# — unpin once fixed upstream.
	deno-version: v2.7.8
	- name: Build
	run: deno task build
	- name: Publish to JSR
	run: deno publish --dry-run

Provide feedback