release: v0.2.0 #1

	name: Release

	on:
	push:
	tags:
	- "v*"

	permissions:
	contents: write
	id-token: write # required for npm provenance

	jobs:
	release:
	name: Build, test, and publish to npm
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: pnpm/action-setup@v4
	with:
	version: 9

	- uses: actions/setup-node@v4
	with:
	node-version: 20
	cache: pnpm
	registry-url: "https://registry.npmjs.org/"

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Build
	run: pnpm build

	- name: Lint
	run: pnpm lint

	- name: Test
	run: pnpm test

	- name: Resolve version
	id: version
	run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

	- name: Verify package.json matches tag
	env:
	EXPECTED: ${{ steps.version.outputs.version }}
	run: \|
	set -euo pipefail
	pkg=$(node -p "require('./package.json').version")
	echo "tag=$EXPECTED package.json=$pkg"
	if [ "$pkg" != "$EXPECTED" ]; then
	echo "::error::package.json version ($pkg) does not match tag ($EXPECTED). Run 'pnpm release' instead of tagging manually."
	exit 1
	fi

	- name: Publish to npm
	env:
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
	run: npm publish --access public --provenance

	- name: Create GitHub Release
	# Pinned to commit SHA of v2.6.2 (third-party action with contents: write).
	# Update by resolving the desired tag with:
	# gh api repos/softprops/action-gh-release/git/refs/tags/<tag> --jq .object.sha
	uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
	with:
	generate_release_notes: true
	draft: false
	prerelease: ${{ contains(github.ref_name, '-') }}

Provide feedback