From 22f30c83c7ea6a961fb4b9b5ad24e1840eef9704 Mon Sep 17 00:00:00 2001
From: Antony Rizzitelli <rizzitelli.antony@pm.me>
Date: Wed, 2 Sep 2026 23:53:56 +0000
Subject: [PATCH 1/2] ci: standardize npm releases

---
 .github/workflows/ci.yml      | 30 +++++++++++++-------
 .github/workflows/release.yml | 53 +++++++++++++++++++++++++++++++++++
 .release-it.json              | 11 ++++++--
 package.json                  |  3 +-
 4 files changed, 83 insertions(+), 14 deletions(-)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 81907ea..16be1a1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,21 +1,31 @@
-name: ci
+name: CI
 
 on:
+  pull_request:
   push:
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
-  ubuntu:
+  checks:
     runs-on: ubuntu-latest
-    env:
-      COREPACK_DEFAULT_TO_LATEST: 0
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
-          node-version: '20'
-      - run: npm i -g --force corepack && corepack enable
-      - run: npm i -g @antelopejs/core
-      - run: pnpm install
+          node-version: 24
+          cache: pnpm
+      - name: Validate pull request title
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          echo "$PR_TITLE" | grep -Eq '^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([^)]+\))?!?: .+'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm add --global @antelopejs/core
       - run: pnpm prepack
       - run: pnpm lint
       - run: pnpm test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..1a64d50
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,53 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      channel:
+        description: npm distribution channel
+        required: true
+        default: latest
+        type: choice
+        options: [latest, next]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: npm-publish
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.RELEASE_GITHUB_TOKEN }}
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm add --global @antelopejs/core
+      - name: Configure release identity
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+      - name: Publish stable release
+        if: inputs.channel == 'latest'
+        run: pnpm release -- --ci
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
+      - name: Publish next release
+        if: inputs.channel == 'next'
+        run: pnpm release -- --ci --preRelease=next
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
diff --git a/.release-it.json b/.release-it.json
index ead0163..e63faee 100644
--- a/.release-it.json
+++ b/.release-it.json
@@ -1,12 +1,17 @@
 {
   "git": {
     "commitMessage": "chore(release): v${version}",
-    "tagName": "v${version}"
+    "tagName": "v${version}",
+    "requireBranch": "main",
+    "requireCommits": true
   },
   "github": {
     "release": true,
-    "releaseName": "v${version}",
-    "web": true
+    "releaseName": "v${version}"
+  },
+  "npm": {
+    "publish": true,
+    "skipChecks": true
   },
   "hooks": {
     "before:init": ["pnpm lint"],
diff --git a/package.json b/package.json
index 3a7fb01..59f8c8f 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,8 @@
     "dist"
   ],
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "license": "Apache-2.0",
   "packageManager": "pnpm@10.6.5",

From ae2b44333946faddf3373d0afad9a82da05b284b Mon Sep 17 00:00:00 2001
From: Antony Rizzitelli <rizzitelli.antony@pm.me>
Date: Thu, 3 Sep 2026 16:05:54 +0000
Subject: [PATCH 2/2] fix(ci): pass release arguments correctly

---
 .github/workflows/release.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1a64d50..489e66d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,11 +43,11 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
       - name: Publish stable release
         if: inputs.channel == 'latest'
-        run: pnpm release -- --ci
+        run: pnpm release --ci
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
       - name: Publish next release
         if: inputs.channel == 'next'
-        run: pnpm release -- --ci --preRelease=next
+        run: pnpm release --ci --preRelease=next
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}