ci: add publish workflow with OIDC trusted publisher

Author: JordanCoin

.github/workflows/publish.yml

@@ -0,0 +1,74 @@
+name: Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: 'Version bump type'
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - run: npm ci
+
+      - name: Run tests
+        run: npm test
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Bump version
+        id: bump
+        run: |
+          # Bump package.json (no git tag yet)
+          NEW_VERSION=$(npm version ${{ inputs.bump }} --no-git-tag-version)
+          echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          echo "version_bare=${NEW_VERSION#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Update version in bin/notion.js
+        run: |
+          sed -i "s/\.version('[^']*')/\.version('${{ steps.bump.outputs.version_bare }}')/" bin/notion.js
+
+      - name: Update version in skill/marketplace.json
+        run: |
+          sed -i 's/"version": "[^"]*"/"version": "${{ steps.bump.outputs.version_bare }}"/' skill/marketplace.json
+
+      - name: Commit, tag, push
+        run: |
+          git add -A
+          git commit -m "chore: bump version to ${{ steps.bump.outputs.version_bare }}"
+          git tag ${{ steps.bump.outputs.version }}
+          git push origin main --tags
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create ${{ steps.bump.outputs.version }} \
+            --title "${{ steps.bump.outputs.version }}" \
+            --generate-notes
+
+      - name: Publish to npm (OIDC trusted publisher — no token needed)
+        run: npm publish --access public --provenance