refactor: consolidate CI jobs into single matrix-based workflow

Merge separate test, build, publish, and release jobs into a single matrix job that runs all steps conditionally. Tests, NPM publishing, and GitHub release creation now run only once on the linux/amd64 build to avoid duplication. Update action versions to v4/v5 and add provenance publishing for NPM.

Author: Flussen

.github/workflows/publish.yml

@@ -10,119 +10,91 @@ permissions:
   id-token: write
 
 jobs:
-  tests:
+  publish:
+    name: Test + Build + Publish + Release
     runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6.0.1
-
-      - name: Set up Go
-        uses: actions/setup-go@v6.1.0
-        with:
-          go-version: "1.24.5"
 
-      - name: Run tests
-        run: go test ./...
-
-  build:
-    name: Build binaries
-    needs: tests
-    runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         include:
-          - os: ubuntu-latest
-            goos: linux
+          - goos: linux
             goarch: amd64
             artifact_name: opencore-linux-amd64
-          - os: macos-latest
-            goos: darwin
+          - goos: darwin
             goarch: amd64
             artifact_name: opencore-darwin-amd64
-          - os: macos-latest
-            goos: darwin
+          - goos: darwin
             goarch: arm64
             artifact_name: opencore-darwin-arm64
-          - os: windows-latest
-            goos: windows
+          - goos: windows
             goarch: amd64
             artifact_name: opencore-windows-amd64.exe
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v6.0.1
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - name: Set up Go
-        uses: actions/setup-go@v6.1.0
+      - name: Setup Go
+        uses: actions/setup-go@v5
         with:
           go-version: "1.24.5"
 
-      - name: Get dependencies
-        run: go mod download
-
+      - name: Go tests
+        if: ${{ matrix.goos == 'linux' && matrix.goarch == 'amd64' }}
+        run: go test ./...
       - name: Build binary
         env:
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
           CGO_ENABLED: 0
         run: |
-          go build -ldflags "-X main.version=${{ github.ref_name }}" -o ${{ matrix.artifact_name }} .
+          go build -ldflags "-X main.version=${{ github.ref_name }}" -o "${{ matrix.artifact_name }}" .
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.artifact_name }}
           path: ${{ matrix.artifact_name }}
 
-  publish-npm:
-    name: Publish to NPM
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6.0.1
-
-      - name: Setup Node.js
+      - name: Setup Node (only once)
+        if: ${{ matrix.goos == 'linux' && matrix.goarch == 'amd64' }}
         uses: actions/setup-node@v4
         with:
-          node-version: '24'
-          registry-url: 'https://registry.npmjs.org'
-          cache: pnpm
+          node-version: "24"
 
-      - name: Update package version
+      - name: Update package version (only once)
+        if: ${{ matrix.goos == 'linux' && matrix.goarch == 'amd64' }}
         run: |
           VERSION=${GITHUB_REF#refs/tags/v}
-          npm version $VERSION --no-git-tag-version --allow-same-version
-
-      - name: Publish to NPM
-        run: npm publish
+          npm version "$VERSION" --no-git-tag-version --allow-same-version
 
+      - name: Publish to NPM (OIDC Trusted Publisher) (only once)
+        if: ${{ matrix.goos == 'linux' && matrix.goarch == 'amd64' }}
+        env:
+          NODE_AUTH_TOKEN: ""
+          NPM_TOKEN: ""
+        run: npm publish --access public --provenance
 
-  release:
-    name: Create Release
-    needs: publish-npm
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6.0.1
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v7.0.0
+      - name: Download all artifacts (only once)
+        if: ${{ matrix.goos == 'linux' && matrix.goarch == 'amd64' }}
+        uses: actions/download-artifact@v4
         with:
           path: ./artifacts
 
-      - name: Prepare release assets
+      - name: Prepare release assets (only once)
+        if: ${{ matrix.goos == 'linux' && matrix.goarch == 'amd64' }}
         run: |
           mkdir -p release
-          find ./artifacts -type f -exec cp {} ./release/ \;
+          find ./artifacts -type f -maxdepth 2 -exec cp {} ./release/ \;
           ls -lah ./release/
 
-      - name: Create Release
-        uses: softprops/action-gh-release@v2.5.0
+      - name: Create Release (only once)
+        if: ${{ matrix.goos == 'linux' && matrix.goarch == 'amd64' }}
+        uses: softprops/action-gh-release@v2
         with:
           files: ./release/*
           draft: false
           prerelease: false
           body_path: RELEASE.md
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}