ci: changesets + OIDC trusted publishing release flow

.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets)
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.0.2/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": ["react-router-app"]
+}

.github/workflows/publish.yaml

@@ -1,19 +1,59 @@
-name: Publish Package to npmjs
+name: Release
+
 on:
-  release:
-    types: [published]
+  push:
+    branches:
+      - main
+  # Manual safety valve: re-run publish for a version that was bumped but never
+  # published. Guarded below so a dispatch can only ever publish from main.
   workflow_dispatch:
+
+concurrency:
+  # Never cancel an in-progress release; queue concurrent runs instead.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write # push the version PR branch, create tags + GitHub releases
+  pull-requests: write # open/update the changesets "Release PR"
+  id-token: write # npm Trusted Publishing (OIDC) — no long-lived NPM_TOKEN needed
+
 jobs:
-  npm-publish:
+  release:
+    name: Release
+    # Don't run on forks; only ever publish from main (incl. workflow_dispatch).
+    if: github.repository_owner == 'code-forge-io' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v4
+      - name: Checkout Repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          node-version: "20.x"
+          fetch-depth: 0
+          # Required so changesets/action can push the version PR branch. Only the
+          # ephemeral GITHUB_TOKEN is persisted (auto-expires at job end) — no PAT.
+          persist-credentials: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          # Pin to Node 24 (ships npm 11.x); npm OIDC Trusted Publishing needs >= 11.5.1.
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
-      - run: npm ci
-      - run: npm publish
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Create Release Pull Request or Publish to npm
+        id: changesets
+        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # Only used to open/update the Release PR and create GitHub releases.
+          # npm authentication is handled by OIDC Trusted Publishing (.npmrc
+          # provenance=true + id-token:write) — there is intentionally no NPM_TOKEN.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          title: "🚀 Release PR"
+          commit: "chore: release"
+          version: npm run changeset:version
+          publish: npm run changeset:publish
+          createGithubReleases: true

.npmrc

@@ -0,0 +1 @@
+provenance=true