ci: standardize npm releases

.github/workflows/ci.yml

@@ -1,21 +1,31 @@
-name: ci
+name: CI
 
 on:
+  pull_request:
   push:
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
-  ubuntu:
+  checks:
     runs-on: ubuntu-latest
-    env:
-      COREPACK_DEFAULT_TO_LATEST: 0
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
-          node-version: '20'
-      - run: npm i -g --force corepack && corepack enable
-      - run: npm i -g @antelopejs/core
-      - run: pnpm install
+          node-version: 24
+          cache: pnpm
+      - name: Validate pull request title
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          echo "$PR_TITLE" | grep -Eq '^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([^)]+\))?!?: .+'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm add --global @antelopejs/core
       - run: pnpm prepack
       - run: pnpm lint
       - run: pnpm test

.github/workflows/release.yml

@@ -0,0 +1,53 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      channel:
+        description: npm distribution channel
+        required: true
+        default: latest
+        type: choice
+        options: [latest, next]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: npm-publish
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.RELEASE_GITHUB_TOKEN }}
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm add --global @antelopejs/core
+      - name: Configure release identity
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+      - name: Publish stable release
+        if: inputs.channel == 'latest'
+        run: pnpm release -- --ci
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
+      - name: Publish next release
+        if: inputs.channel == 'next'
+        run: pnpm release -- --ci --preRelease=next
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}

.release-it.json

@@ -1,12 +1,17 @@
 {
   "git": {
     "commitMessage": "chore(release): v${version}",
-    "tagName": "v${version}"
+    "tagName": "v${version}",
+    "requireBranch": "main",
+    "requireCommits": true
   },
   "github": {
     "release": true,
-    "releaseName": "v${version}",
-    "web": true
+    "releaseName": "v${version}"
+  },
+  "npm": {
+    "publish": true,
+    "skipChecks": true
   },
   "hooks": {
     "before:init": ["pnpm lint"],

package.json

@@ -18,7 +18,8 @@
     "dist"
   ],
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "license": "Apache-2.0",
   "packageManager": "pnpm@10.6.5",