From 0fd84e72be03754979939655f216c5aafd9a9e85 Mon Sep 17 00:00:00 2001
From: Nate Goldman <427322+ungoldman@users.noreply.github.com>
Date: Sat, 13 Jun 2026 18:06:05 -0700
Subject: [PATCH 1/2] ci: add release-please and oidc publishing

Adopt release-please in simple mode (seeds from the v3.0.1 tag): it
opens a release PR from conventional commits, and on merge tags, cuts
the GitHub release, and the publish job ships to npm via OIDC trusted
publishing (no token, automatic provenance).
---
 .github/workflows/release.yml | 38 +++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..d4a3c8f
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,38 @@
+name: release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+    steps:
+      - uses: googleapis/release-please-action@v5
+        id: release
+        with:
+          release-type: node
+          include-component-in-tag: false
+
+  publish:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm ci
+      - run: npm publish

From 9f61768b8fe63002298a1f8e6427fc600349418c Mon Sep 17 00:00:00 2001
From: Nate Goldman <427322+ungoldman@users.noreply.github.com>
Date: Sat, 13 Jun 2026 18:06:23 -0700
Subject: [PATCH 2/2] chore: remove the manual npm version release scripts

release-please now owns versioning, tagging, the GitHub release, and
the npm publish, so the manual release, prerelease, and postrelease
scripts are gone.
---
 package.json | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/package.json b/package.json
index f56317b..f332fa2 100644
--- a/package.json
+++ b/package.json
@@ -60,11 +60,8 @@
     "coverage": "node --test --experimental-test-coverage --import=tsx --test-coverage-exclude='test/**' --test-coverage-lines=100 --test-coverage-branches=100 --test-coverage-functions=100 test/*.test.ts",
     "format": "biome check --write .",
     "lint": "biome check .",
-    "postrelease": "git push --follow-tags && npm publish",
     "prebuild": "rm -rf dist",
     "prepublishOnly": "npm run build",
-    "prerelease": "git fetch --tags && npm test && npm run test:pack",
-    "release": "npm version patch",
     "test": "npm run lint && npm run typecheck && npm run build && node --test --import=tsx test/*.test.ts",
     "test:pack": "bash scripts/test-pack.sh",
     "test:watch": "node --test --watch --import=tsx test/*.test.ts",