From 1f9ea499ada1646f4c0eb341a41758b3891356e4 Mon Sep 17 00:00:00 2001
From: F88 <685250+F88@users.noreply.github.com>
Date: Thu, 23 Jul 2026 14:09:14 +0900
Subject: [PATCH] ci: add npm publish workflow

Publish to npmjs.com via Trusted Publishing (OIDC) with provenance,
triggered by a published GitHub Release or manually via
workflow_dispatch. A build job (typecheck, format check, lint,
tests) gates the publish job.

Publishing stays blocked by the prepublishOnly guard in
package.json until the release preparation replaces it with the
build script.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../workflows/publish-package-to-npmjs.yml    | 68 +++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 .github/workflows/publish-package-to-npmjs.yml

diff --git a/.github/workflows/publish-package-to-npmjs.yml b/.github/workflows/publish-package-to-npmjs.yml
new file mode 100644
index 0000000..fbbc0ce
--- /dev/null
+++ b/.github/workflows/publish-package-to-npmjs.yml
@@ -0,0 +1,68 @@
+name: Publish package to npmjs.com
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build and test package
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '22.x'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm run format:check
+      - run: npm run lint
+      - run: npm test
+
+  publish-to-npm:
+    name: Publish npm package to npmjs.com
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '22.x'
+          registry-url: 'https://registry.npmjs.org'
+
+      # Trusted publishing requires npm 11.5.1 or later
+      # https://docs.npmjs.com/trusted-publishers
+      - name: Update npm
+        run: npm install -g npm@latest
+
+      - name: Show npm version
+        run: npm -v
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build package for release
+        run: npm run build
+
+      - name: Publish to npmjs.com
+        run: >-
+          npm
+          --loglevel notice
+          publish
+          --provenance
+          --access public