ci: automate secure npm releases

.github/workflows/ci.yml

@@ -1,21 +1,30 @@
-name: ci
+name: CI
 
 on:
+  pull_request:
   push:
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
-  ubuntu:
+  checks:
     runs-on: ubuntu-latest
-    env:
-      COREPACK_DEFAULT_TO_LATEST: 0
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
-          node-version: '20'
-      - run: npm i -g --force corepack && corepack enable
-      - run: npm i -g @antelopejs/core
-      - run: pnpm install
-      - run: pnpm prepack
+          node-version: 24
+          cache: pnpm
+      - name: Validate pull request title
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          echo "$PR_TITLE" | grep -Eq '^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([^)]+\))?!?: .+'
+      - run: pnpm install --frozen-lockfile
       - run: pnpm lint
       - run: pnpm test
+      - run: pnpm test:package

.github/workflows/release.yml

@@ -0,0 +1,53 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      channel:
+        description: npm distribution channel
+        required: true
+        default: latest
+        type: choice
+        options:
+          - latest
+          - next
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: npm-publish
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          fetch-depth: 0
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: Configure release identity
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+      - name: Publish stable release
+        if: inputs.channel == 'latest'
+        run: pnpm release -- --ci
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Publish next release
+        if: inputs.channel == 'next'
+        run: pnpm release -- --ci --preRelease=next
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.release-it.json

@@ -1,12 +1,17 @@
 {
   "git": {
     "commitMessage": "chore(release): v${version}",
-    "tagName": "v${version}"
+    "tagName": "v${version}",
+    "requireBranch": "main",
+    "requireCommits": true
   },
   "github": {
     "release": true,
-    "releaseName": "v${version}",
-    "web": true
+    "releaseName": "v${version}"
+  },
+  "npm": {
+    "publish": true,
+    "skipChecks": true
   },
   "hooks": {
     "before:init": ["pnpm lint"],

package.json

@@ -77,8 +77,8 @@
     "lint:fix": "biome check --write .",
     "lint": "biome check .",
     "prepack": "pnpm run build",
-    "release": "pnpm run lint && pnpm run prepack && release-it",
-    "test": "pnpm run build && ajs module test .",
+    "release": "pnpm run lint && pnpm run test && pnpm run test:package && pnpm run prepack && release-it",
+    "test": "pnpm run build && mocha 'dist/tests/**/*.test.js'",
     "test:package": "node test/package-consumer.mjs"
   },
   "antelopeJs": {
@@ -96,12 +96,14 @@
     "@types/mocha": "^10.0.10",
     "@types/node": "^22.19.15",
     "chai": "^4.5.0",
+    "mocha": "^11.7.5",
     "release-it": "^19.2.4",
     "release-it-changelogen": "^0.1.0",
     "rimraf": "^6.1.3",
     "typescript": "^5.9.3"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }