feat(release): move npm publish to github actions

.github/workflows/release.yml

@@ -0,0 +1,69 @@
+name: Manual Release
+
+on:
+    workflow_dispatch:
+        inputs:
+            release_version:
+                description: 'Semver version to release (must be > current root version)'
+                required: true
+
+permissions:
+    contents: write
+    pull-requests: write
+    id-token: write
+    packages: write
+
+jobs:
+    release:
+        environment: release
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+              with:
+                  fetch-depth: 0
+
+            - name: Setup Node
+              uses: actions/setup-node@v4
+              with:
+                  node-version: '20'
+                  registry-url: 'https://registry.npmjs.org'
+                  cache: 'yarn'
+
+            - name: Install dependencies
+              run: yarn install --frozen-lockfile
+
+            - name: Validate release version > current
+              env:
+                  INPUT_VERSION: ${{ inputs.release_version }}
+              run: |
+                  node -e "
+                  const fs=require('fs');
+                  const semver=require('semver');
+                  const current=JSON.parse(fs.readFileSync('package.json','utf8')).version;
+                  const next=process.env.INPUT_VERSION;
+                  if(!semver.valid(next)) { console.error('Invalid semver: '+next); process.exit(1); }
+                  if(!semver.gt(next,current)) { console.error(`Version ${next} must be greater than current ${current}`); process.exit(1); }
+                  "
+
+            - name: Bump versions and commit
+              env:
+                  INPUT_VERSION: ${{ inputs.release_version }}
+              run: |
+                  git config user.name "github-actions[bot]"
+                  git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+                  BRANCH="$GITHUB_REF_NAME"
+                  node ./scripts/release/version.js "$INPUT_VERSION"
+                  RESOLVED_VERSION=$(node -p "require('./package.json').version")
+                  git commit -am "chore: release $RESOLVED_VERSION"
+                  git push origin HEAD
+
+            - name: Build
+              run: yarn build
+
+            - name: Publish to npm
+              env:
+                  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+              run: |
+                  TAG=$([ "$GITHUB_REF_NAME" = "master" ] && echo latest || echo "$GITHUB_REF_NAME")
+                  yarn nx release publish --yes --registry https://registry.npmjs.org --tag "$TAG"