Add GitHub Actions for npm deploy (release + snapshot)

.github/workflows/deployRelease.yml

@@ -0,0 +1,87 @@
+# Deploy Release — Publishes a numbered release to npm.
+#
+# Manually triggered. Standard releases run from master; hotfixes run from a dedicated
+# branch. Validates the version input, publishes to npm, tags the commit, and creates a
+# GitHub release with auto-generated notes. For snapshot builds, see Deploy Snapshot.
+
+name: Deploy Release
+
+on:
+    workflow_dispatch:
+        inputs:
+            version:
+                description: 'Release Version'
+                required: true
+                type: string
+            is-hotfix:
+                description: 'As hotfix. Check when releasing a hotfix to a version other than the latest.'
+                required: true
+                default: false
+                type: boolean
+
+# Run all release builds one-by-one, but never cancel a release build due to another one.
+concurrency:
+    group: deploy-release
+    cancel-in-progress: false
+
+jobs:
+    build:
+        # Guards against accidental release from develop. Requires master for standard
+        # releases and a branch other than master (or develop) when is-hotfix is set.
+        if: github.ref != 'refs/heads/develop' && ((github.ref == 'refs/heads/master') != inputs.is-hotfix)
+
+        runs-on: ubuntu-latest
+        permissions:
+            contents: write
+
+        steps:
+        - uses: actions/checkout@v6
+          with:
+              fetch-depth: 0
+              fetch-tags: true
+
+        # Checkout is required to be called with `fetch-depth: 0` and `fetch-tags: true`.
+        - name: Validate release version
+          uses: xh/hoist-dev-utils/.github/actions/validate-release-version@master
+          with:
+              version: ${{ inputs.version }}
+              is-hotfix: ${{ inputs.is-hotfix }}
+
+        - name: Setup Node.js
+          uses: actions/setup-node@v6
+          with:
+              node-version-file: '.nvmrc'
+              registry-url: 'https://registry.npmjs.org'
+              cache: 'yarn'
+
+        - name: Install dependencies
+          run: yarn install --frozen-lockfile
+
+        - name: Set release version in package.json
+          env:
+              VERSION: ${{ inputs.version }}
+          run: npm version --no-git-tag-version --new-version "$VERSION"
+
+        - name: Publish release to npm
+          env:
+              NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+              IS_HOTFIX: ${{ inputs.is-hotfix }}
+          run: |
+              TAG_FLAG=""
+              if [ "$IS_HOTFIX" = "true" ]; then
+                  TAG_FLAG="--tag hotfix"
+              fi
+              npm publish $TAG_FLAG
+
+        # Note: The tag intentionally points to a commit where package.json still has the
+        # SNAPSHOT version. We chose not to commit the version change back to the repo to
+        # avoid paired set/reset commits on every release. The published npm artifact has
+        # the correct release version — the tag is just a pointer to the source commit.
+        # Checkout is required to be called with `fetch-depth: 0` and `fetch-tags: true`.
+        - name: Tag and create GitHub release
+          uses: xh/hoist-dev-utils/.github/actions/create-tag-and-github-release@master
+          env:
+              GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          with:
+              version: ${{ inputs.version }}
+              is-hotfix: ${{ inputs.is-hotfix }}

.github/workflows/deploySnapshot.yml

@@ -0,0 +1,54 @@
+# Deploy Snapshot — Publishes a SNAPSHOT build to npm on every push to develop.
+#
+# Snapshots are mutable development builds (version from package.json, e.g. 8.0.0-SNAPSHOT).
+# They are published with the `next` dist-tag so they don't affect `latest`. For numbered
+# releases, see Deploy Release.
+
+name: Deploy Snapshot
+
+on:
+    push:
+        branches: [ "develop" ]
+    workflow_dispatch:
+        inputs:
+            version:
+                description: '(Optional) Snapshot version to override default in package.json. Note that the suffix "-SNAPSHOT" will be automatically appended if not present.'
+                required: false
+                default: ''
+                type: string
+
+# Debounce builds by branch. Newer runs from a branch will cancel the current run and start over.
+concurrency:
+    group: deploy-snapshot-${{ github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    build:
+
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+
+        steps:
+        - uses: actions/checkout@v6
+
+        - name: Setup Node.js
+          uses: actions/setup-node@v6
+          with:
+              node-version-file: '.nvmrc'
+              registry-url: 'https://registry.npmjs.org'
+              cache: 'yarn'
+
+        - name: Install dependencies
+          run: yarn install --frozen-lockfile
+
+        - name: Prepare snapshot version
+          id: snapshot
+          uses: xh/hoist-dev-utils/.github/actions/prepare-npm-snapshot-version@master
+          with:
+              version: ${{ inputs.version }}
+
+        - name: Publish snapshot to npm
+          env:
+              NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          run: npm publish --tag next

.nvmrc

@@ -0,0 +1 @@
+lts/*