From 47a69d9bf5c85340d4af0e49c589629c4c404915 Mon Sep 17 00:00:00 2001
From: Olivier Louvignes <olivier@mg-crea.com>
Date: Wed, 26 Aug 2026 11:14:31 +0200
Subject: [PATCH 1/2] ci: add tag-triggered npm publish workflow

Publishes to npm when a semver tag is pushed. Runs the full lint/check/spec/build
gate first and fails fast if the tag does not match package.json version.
Uses OIDC provenance; requires an NPM_TOKEN repository secret.
---
 .github/workflows/publish.yaml | 53 ++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 .github/workflows/publish.yaml

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
new file mode 100644
index 0000000..b1bebb1
--- /dev/null
+++ b/.github/workflows/publish.yaml
@@ -0,0 +1,53 @@
+name: Publish Package
+
+on:
+  push:
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+"
+      - "[0-9]+.[0-9]+.[0-9]+-*"
+  workflow_dispatch:
+
+# Required for npm provenance (OIDC) and for creating the GitHub release
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    name: Publish to npm
+    steps:
+      - name: Checkout 🛎️
+        uses: actions/checkout@v5
+      - name: Setup pnpm 🔧
+        uses: pnpm/action-setup@v4
+      - name: Setup Node.js 🔧
+        uses: actions/setup-node@v6
+        with:
+          node-version: "lts/*"
+          check-latest: true
+          cache: "pnpm"
+          registry-url: "https://registry.npmjs.org"
+      - name: Verify tag matches package.json version 🔍
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          PKG="$(node -p "require('./package.json').version")"
+          if [ "$TAG" != "$PKG" ]; then
+            echo "::error::Tag '$TAG' does not match package.json version '$PKG'"
+            exit 1
+          fi
+          echo "Publishing version $PKG"
+      - name: Install dependencies 🪄
+        run: pnpm install --frozen-lockfile
+      - name: Lint 🔍
+        run: pnpm run lint
+      - name: TypeScript 🔍
+        run: pnpm run check
+      - name: Vitest 🔍
+        run: pnpm run spec
+      - name: Build 💎
+        run: pnpm run build
+      - name: Publish to npm 🚀
+        run: pnpm publish --access public --provenance --no-git-checks
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

From fd1328a35277dbca70291b79f5fb5aef99302bf1 Mon Sep 17 00:00:00 2001
From: Olivier Louvignes <olivier@mg-crea.com>
Date: Wed, 26 Aug 2026 11:28:51 +0200
Subject: [PATCH 2/2] fix(ci): publish with npm so --provenance is honored

pnpm publish accepts --provenance but silently ignores it, which would
produce a successful publish with no attestation. npm publish implements
provenance via the OIDC token, so use it for the publish step while keeping
pnpm for install and the build/test gate.
---
 .github/workflows/publish.yaml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index b1bebb1..ceb48da 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -7,9 +7,9 @@ on:
       - "[0-9]+.[0-9]+.[0-9]+-*"
   workflow_dispatch:
 
-# Required for npm provenance (OIDC) and for creating the GitHub release
+# id-token: write is required for npm provenance (OIDC)
 permissions:
-  contents: write
+  contents: read
   id-token: write
 
 jobs:
@@ -47,7 +47,9 @@ jobs:
         run: pnpm run spec
       - name: Build 💎
         run: pnpm run build
+      # Published with npm, not pnpm: pnpm publish accepts --provenance but
+      # silently ignores it, yielding a publish with no attestation.
       - name: Publish to npm 🚀
-        run: pnpm publish --access public --provenance --no-git-checks
+        run: npm publish --access public --provenance --ignore-scripts
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}