Automate releases with Changesets and OIDC publishing (#149) #39

	name: Release

	on:
	push:
	branches: [main]

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: write
	pull-requests: write
	id-token: write

	jobs:
	release:
	name: Release
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup pnpm
	uses: pnpm/action-setup@v4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: '22'
	cache: pnpm
	registry-url: 'https://registry.npmjs.org'

	# Trusted publishing (OIDC) needs npm >= 11.5.1; the version bundled with
	# Node does not satisfy this yet.
	- name: Update npm for trusted publishing
	run: npm install -g npm@latest

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	# Opens/updates the "Version Packages" PR while changesets accumulate, then
	# runs `pnpm release` to publish once that PR merges. Publishing authenticates
	# via OIDC against the npm trusted publisher — no NPM_TOKEN. `commitMode:
	# github-api` makes the bot's commits and tags signed, satisfying the
	# require-signed-commits ruleset.
	- name: Create Release Pull Request or Publish
	uses: changesets/action@v1
	with:
	publish: pnpm release
	commitMode: github-api
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback