From 5e577dd9d181c893db44ebd327c39d1c40069014 Mon Sep 17 00:00:00 2001
From: Lovell Fuller <github@lovell.info>
Date: Fri, 12 Dec 2025 15:05:40 +0000
Subject: [PATCH] CI: Automate trusted publishing based on semver tags

---
 .github/workflows/ci.yml | 21 ++++++++++++++++++---
 package.json             |  4 ++--
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 989c373..a100c66 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,12 +4,27 @@ on:
   - pull_request
 permissions: {}
 jobs:
-  CI:
+  test:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: current
       - run: npm install
       - run: npm test
+  publish:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: test
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: current
+      - run: npm publish
diff --git a/package.json b/package.json
index 1b9a7cc..8cca427 100644
--- a/package.json
+++ b/package.json
@@ -32,8 +32,8 @@
   "devDependencies": {
     "@types/node": "*",
     "chance-generators": "^3.5.2",
-    "mocha": "^10.2.0",
-    "tsd": "^0.31.2",
+    "mocha": "^11.7.5",
+    "tsd": "^0.33.0",
     "unexpected": "^13.1.0",
     "unexpected-check": "^3.1.0"
   }