ci(release): add tag-driven publish pipeline

[eumaninho54]

Why

There was no release pipeline: version 0.0.0, no tags, no CHANGELOG.md, and release-it still on the create-react-native-library defaults — publishing to npm from a laptop with a long-lived token.

This splits the release in two: local decides the version, CI builds and publishes.

What changed

.github/workflows/release.yml (new), triggered on v* tags:

• verify — lint, format:check, typecheck, unit tests.
• publish — needs verify, runs with id-token: write so npm authenticates over OIDC:
  1. fails if the runner's npm is older than 11.5.1 (the floor for trusted publishing);
  2. fails if the tag does not match package.json;
  3. yarn prepare, then greps lib/ for @/ — the repo's non-negotiable is now a release gate;
  4. npm publish --provenance --access public, skipped when the version is already on npm;
  5. gh release create with the top section of CHANGELOG.md as notes.

package.json — release-it stops publishing:

key	before	after
npm.publish	true	false — CI publishes
github.release	true	false — CI creates it
git.requireBranch	—	main
conventional-changelog.infile	—	CHANGELOG.md

The first release is by hand

npm requires a package to exist before a trusted publisher can be registered, so 0.1.0 goes up manually. That is why the publish step skips an already-published version — the first tag still flows through the same pipeline and gets its GitHub release.

1. merge this PR
2. yarn release --no-git.push → pick minor, 0.1.0
3. yarn prepare && npm publish --access public
4. register the trusted publisher on npmjs.com: repo Salve-Software/react-native-cicerone, workflow release.yml
5. git push --follow-tags

From 0.2.0 on it is just yarn release; no npm token ever lives in the repository.

Worth a second opinion

release-it commits and pushes the version bump straight to main. If main has branch protection blocking pushes, step 5 fails and the protection needs a bypass for the release author.

🤖 Generated with Claude Code