[nonchalanttee22-lgtm]

Summary
The SDK could only be installed from git because there was no release workflow, even though package.json already declares its published files (dist, README.md, LICENSE). This PR adds a release workflow triggered on v* tags that checks the tag against the package version, runs checks and the build, publishes to npm with provenance, and creates a GitHub release. It also documents the process in CONTRIBUTING.md.

Closes #3

Validation

Both runs are real GitHub Actions runs of this workflow, not a local replay. act was not usable from my environment (the Docker socket is not accessible), so I added a rehearsal entry point instead: a manual run executes every step except the upload and the release, which are gated on github.event_name == 'push'. A branch cannot publish.

• Matching tag, v0.1.0 — success: https://github.com/nonchalanttee22-lgtm/keygate-client/actions/runs/41603043328
  Steps, in order: install from the lockfile, Tag matches package.json, pnpm check, pnpm build, npm upgrade, npm publish --dry-run plus tarball assertions. Publish to npm shows as skipped because this was a manual run, and the release job is skipped for the same reason.
• Mismatched tag, v0.2.0 — failure, as required: https://github.com/nonchalanttee22-lgtm/keygate-client/actions/runs/41603251363

  tag=v0.2.0
  package.json version=0.1.0
  ##[error]tag v0.2.0 does not match package.json version (expected v0.1.0)
  ##[error]Process completed with exit code 1.
  

  Check, Build, the npm upgrade, the tarball check and Publish to npm are all skipped after the guard fails.

npm name

keygate-client is free: npm view keygate-client returns E404 Not Found - GET https://registry.npmjs.org/keygate-client. No scoped name is needed and package.json is unchanged.

---

What changed

.github/workflows/release.yml (new)

• Triggers on tags matching v*, plus workflow_dispatch with a tag input for rehearsal (upload and release are skipped on manual runs).
• publish job: contents: read and id-token: write; the separate release job gets contents: write, so the step that publishes to npm never holds write access.
• Checks out the repo, sets up Node 20, runs corepack enable, then pnpm install --frozen-lockfile.
• Fails the job if the tag does not equal v + the version in package.json, before check, build or any publish step.
• Runs pnpm check, then pnpm build, then npm publish --dry-run + npm pack --dry-run assertions that dist/index.js, dist/index.d.ts, LICENSE and README.md ship.
• Installs npm ^11.5.1 before publishing: Node 20 bundles npm 10, and npm's OIDC/trusted publishing needs 11.5.1 or later.
• Publishes with npm publish --provenance --access public.
• Creates a GitHub release with generated notes.
• No token is stored in the repo. Publishing uses the NPM_TOKEN secret (passed as NODE_AUTH_TOKEN), or npm trusted publishing when the maintainer configures it and leaves the secret unset.
• Provenance needs repository.url in package.json to match the repository running the workflow (case-sensitively). It does: git+https://github.com/TeethakingBuilds/keygate-client.git. Releases must therefore run upstream; a fork publishing the same name would be rejected with E422.

CONTRIBUTING.md

• New "Releasing" section: bump the version, optionally rehearse the workflow from the Actions tab, tag the merge commit, and what the workflow checks. It also covers the version-mismatch failure, the two authentication setups, the npm 11 requirement, the provenance/repository requirement, and why a published version cannot be reused.

---

How to verify

• The two run links above: one green through the tarball check, one failing at the version guard with everything after it skipped.
• Confirm the publish job's runner log reports Contents: read (visible near the top of the failing run's log).
• Confirm no token or secret value appears anywhere in the repo.
• Read the new CONTRIBUTING.md section and follow it as written.

---

Checklist

• release.yml triggers on v* tags
• Node 20, corepack enable, pnpm install --frozen-lockfile
• Job fails if the tag does not equal v + package.json version
• pnpm check and pnpm build run before publish
• npm publish --provenance --access public with id-token: write and contents: read
• GitHub release created with generated notes
• keygate-client name availability checked, scoped name proposed in the issue if taken
• CONTRIBUTING.md has a "Releasing" section
• No token stored in the repo
• Workflow validated with --dry-run or act, log linked in the PR
• Closes Publish to npm from a tagged release with provenance #3