ci: automate CLI releases with Changesets

.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Every user-facing CLI change must include a changeset created with `pnpm changeset`.
+Choose the SemVer bump that matches the change and commit the generated Markdown file.
+
+After that change reaches `main`, GitHub creates or updates the **Version Packages**
+pull request. Merging that generated pull request updates the package version and
+changelog; the release workflow then publishes the new version to npm through OIDC.

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.changeset/silent-ants-rest.md

@@ -0,0 +1,5 @@
+---
+"@freeticket/cli": patch
+---
+
+Automate npm releases through GitHub Actions trusted publishing.

.github/workflows/release.yml

@@ -2,7 +2,7 @@ name: Release
 
 on:
   push:
-    tags: ["v*"]
+    branches: [main]
 
 jobs:
   publish:
@@ -18,11 +18,23 @@ jobs:
           node-version: 22
           cache: pnpm
           registry-url: "https://registry.npmjs.org"
+      - id: version
+        run: |
+          package_name="$(node -p "require('./package.json').name")"
+          local_version="$(node -p "require('./package.json').version")"
+          published_version="$(npm view "$package_name" version 2>/dev/null || true)"
+
+          if [ "$local_version" = "$published_version" ]; then
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+          fi
       - run: pnpm install --frozen-lockfile
       - run: pnpm generate
       - run: pnpm test
       - run: pnpm build
       # npm Trusted Publishing exchanges this GitHub OIDC identity for a
       # short-lived publish credential; no long-lived NPM_TOKEN is stored.
       - run: npm install --global npm@latest
-      - run: npm publish --provenance --access public
+      - if: steps.version.outputs.publish == 'true'
+        run: npm publish --provenance --access public

.github/workflows/version-packages.yml

@@ -0,0 +1,31 @@
+name: Version Packages
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: version-packages-main
+  cancel-in-progress: false
+
+jobs:
+  version:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - uses: changesets/action@v1
+        with:
+          version: pnpm changeset version
+          commit: "chore: version packages"
+          title: "chore: version packages"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -161,6 +161,13 @@ pnpm test         # vitest
 pnpm lint         # biome
 ```
 
+### Releases
+
+Use `pnpm changeset` for every user-facing CLI change and commit the generated
+file in `.changeset/`. Once the change is merged to `main`, GitHub opens or
+updates a version PR. Merging that version PR publishes the new package version
+to npm automatically with provenance; no npm token or manual tag is required.
+
 ### Keeping the client in sync with the backend
 
 The contract is committed in [`openapi.json`](./openapi.json). When the backend

package.json

@@ -42,6 +42,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
+    "changeset": "changeset",
     "prepublishOnly": "pnpm build"
   },
   "dependencies": {
@@ -52,6 +53,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.2.0",
+    "@changesets/cli": "^2.31.0",
     "@hey-api/openapi-ts": "^0.64.0",
     "@types/node": "^22.10.0",
     "tsup": "^8.4.0",