ci: automate releases with release-please, OIDC publish and PR-title lint

.github/workflows/pr-title-lint.yml

@@ -0,0 +1,39 @@
+name: Lint PR Title
+
+# PRs are squash-merged, so the PR title becomes the commit message on master.
+# Enforcing Conventional Commits here keeps the history clean and lets
+# release-please categorise changes into the changelog correctly.
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+      - reopened
+
+permissions:
+  pull-requests: write
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          # Keep in sync with the changelog-sections in release-please-config.json.
+          types: |
+            feat
+            fix
+            perf
+            refactor
+            revert
+            docs
+            chore
+            ci
+            test
+            build
+            style
+          # Scopes are allowed (e.g. feat(parser)) but not required.
+          requireScope: false

.github/workflows/publish.yml

@@ -0,0 +1,61 @@
+name: Publish to npm
+
+on:
+  # Manual publish, with a choice of dist-tag (for prereleases etc.).
+  workflow_dispatch:
+    inputs:
+      dist_tag:
+        description: 'npm dist-tag to publish under'
+        type: choice
+        default: latest
+        required: true
+        options:
+          - latest
+          - beta
+          - next
+
+  # Called by release-please.yml right after it cuts a release, so merging the
+  # `chore(main): release X.Y.Z` PR publishes automatically. A reusable-workflow
+  # call (rather than `on: release`) is used because a Release created with the
+  # default GITHUB_TOKEN does not trigger event-based workflows.
+  workflow_call:
+    inputs:
+      dist_tag:
+        description: 'npm dist-tag to publish under'
+        type: string
+        default: latest
+        required: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    # OIDC trusted publishing: the id-token is exchanged with npm at publish
+    # time, so no NPM_TOKEN secret is needed. It also enables provenance.
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+          cache: npm
+
+      # Trusted publishing requires npm >= 11.5.1; node 22 ships an older npm.
+      - name: Upgrade npm
+        run: npm install -g npm@latest
+
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm run test:coverage
+      - run: npm run build
+
+      - name: Publish to npm
+        # `inputs.dist_tag` comes from workflow_dispatch (chosen) or workflow_call
+        # (defaults to latest).
+        run: npm publish --provenance --access public --tag "${{ inputs.dist_tag }}"

.github/workflows/release-please.yml

@@ -0,0 +1,40 @@
+name: Release Please
+
+# Maintains a "release PR" that bumps the version and updates CHANGELOG.md from
+# Conventional Commits as they land on master. Merging that PR creates the git
+# tag (vX.Y.Z) and the GitHub Release, and then publishes to npm via the publish
+# workflow (called below only when a release was actually created).
+on:
+  push:
+    branches:
+      - master
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+    steps:
+      - uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          # Reads release-please-config.json and .release-please-manifest.json
+          # from the repo root.
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  # Runs only when the previous job just cut a release (i.e. the release PR was
+  # merged). Calls the publish workflow as a reusable workflow so npm publishing
+  # stays defined in one place (publish.yml) and keeps OIDC trusted publishing.
+  publish:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    permissions:
+      id-token: write
+      contents: read
+    uses: ./.github/workflows/publish.yml
+    with:
+      dist_tag: latest

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.0.0"
+}

release-please-config.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    ".": {
+      "release-type": "node",
+      "changelog-path": "CHANGELOG.md",
+      "include-component-in-tag": false,
+      "include-v-in-tag": true,
+      "release-as": "2.0.0",
+      "changelog-sections": [
+        { "type": "feat", "section": "Added" },
+        { "type": "fix", "section": "Fixed" },
+        { "type": "perf", "section": "Performance" },
+        { "type": "refactor", "section": "Changed" },
+        { "type": "revert", "section": "Reverted" },
+        { "type": "docs", "section": "Documentation", "hidden": true },
+        { "type": "chore", "hidden": true },
+        { "type": "ci", "hidden": true },
+        { "type": "test", "hidden": true },
+        { "type": "build", "hidden": true },
+        { "type": "style", "hidden": true }
+      ]
+    }
+  }
+}