ci: combine npm + cargo release workflows into one

.github/workflows/package-release.yaml

@@ -0,0 +1,128 @@
+name: Package Release
+on:
+  push:
+    branches:
+      - main
+jobs:
+  release:
+    if: ${{ github.ref == 'refs/heads/main' && !startsWith(github.event.head_commit.message, 'Package Release') }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ssh-key: ${{ secrets.PUBLISH_PRIVATE_KEY }}
+          fetch-depth: 0
+      - uses: nixbuild/nix-quick-install-action@v30
+        with:
+          nix_conf: |
+            keep-env-derivations = true
+            keep-outputs = true
+      - name: Restore and save Nix store
+        uses: nix-community/cache-nix-action@v6
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+          gc-max-store-size-linux: 1G
+      - name: Install NodeJS v22
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: "npm"
+      - run: nix develop -c forge soldeer install
+      - name: Test JS/TS bindings
+        run: nix develop -c test-js-bindings
+      - name: Cargo test
+        run: nix develop -c cargo test -p rain-math-float
+      - name: Git Config
+        run: |
+          git config --global user.email "${{ secrets.CI_GIT_EMAIL }}"
+          git config --global user.name "${{ secrets.CI_GIT_USER }}"
+      # NPM hash detection
+      - name: NPM hashes
+        id: npm
+        run: |
+          OLD=$(npm view @rainlanguage/float@latest dist.shasum 2>/dev/null || echo "none")
+          NEW=$(npm pack --silent | xargs shasum | cut -c1-40)
+          rm -f *.tgz
+          echo "old=$OLD" >> $GITHUB_OUTPUT
+          echo "new=$NEW" >> $GITHUB_OUTPUT
+          if [ "$OLD" = "$NEW" ]; then echo "changed=false" >> $GITHUB_OUTPUT; else echo "changed=true" >> $GITHUB_OUTPUT; fi
+      # Cargo hash detection
+      - name: Cargo hashes
+        id: cargo
+        run: |
+          NEW=$(nix develop -c cargo package -p rain-math-float --allow-dirty --quiet --list | LC_ALL=C sort | sha256sum | cut -d' ' -f1)
+          OLD_VERSION=$(curl -fsSL "https://crates.io/api/v1/crates/rain-math-float" | python3 -c "import sys, json; print(json.load(sys.stdin)['crate']['max_version'])" 2>/dev/null || echo "none")
+          if [ "$OLD_VERSION" = "none" ]; then
+            OLD="none"
+          else
+            curl -fsSL "https://crates.io/api/v1/crates/rain-math-float/$OLD_VERSION/download" -o /tmp/old.crate
+            OLD=$(tar -tzf /tmp/old.crate 2>/dev/null | LC_ALL=C sort | sha256sum | cut -d' ' -f1)
+          fi
+          echo "old=$OLD" >> $GITHUB_OUTPUT
+          echo "new=$NEW" >> $GITHUB_OUTPUT
+          if [ "$OLD" = "$NEW" ]; then echo "changed=false" >> $GITHUB_OUTPUT; else echo "changed=true" >> $GITHUB_OUTPUT; fi
+      # NPM version bump + tag (no push yet — batch with cargo)
+      - name: Bump NPM version
+        if: ${{ steps.npm.outputs.changed == 'true' }}
+        run: |
+          NEW=$(npm version prerelease --preid alpha --no-git-tag-version)
+          echo "NPM_VERSION=$NEW" >> $GITHUB_ENV
+          git add package.json package-lock.json
+      # Cargo version bump + tag (no push yet — batch with npm)
+      - name: Bump Cargo version
+        if: ${{ steps.cargo.outputs.changed == 'true' }}
+        run: |
+          nix develop -c cargo release --no-confirm --execute --no-tag --no-push -p rain-math-float alpha
+          echo "CARGO_VERSION=v$(cargo pkgid -p rain-math-float | cut -d@ -f2)" >> $GITHUB_ENV
+      # Single push of both bump commits (cargo-release made its own commit;
+      # the npm bump is staged into a separate commit here).
+      - name: Commit and push version bumps
+        if: ${{ steps.npm.outputs.changed == 'true' || steps.cargo.outputs.changed == 'true' }}
+        run: |
+          if [ "${{ steps.npm.outputs.changed }}" = "true" ]; then
+            git commit -m "Package Release npm-${{ env.NPM_VERSION }}"
+          fi
+          if [ -n "${{ env.NPM_VERSION }}" ]; then git tag npm-${{ env.NPM_VERSION }}; fi
+          if [ -n "${{ env.CARGO_VERSION }}" ]; then git tag crate-${{ env.CARGO_VERSION }}; fi
+          git push origin main
+          git push origin --tags
+      # NPM publish
+      - name: NPM pack
+        if: ${{ steps.npm.outputs.changed == 'true' }}
+        run: |
+          TARBALL=$(npm pack --silent)
+          mv "$TARBALL" float_npm_package_${{ env.NPM_VERSION }}.tgz
+      - name: Publish to NPM
+        if: ${{ steps.npm.outputs.changed == 'true' }}
+        uses: JS-DevTools/npm-publish@v3
+        with:
+          token: ${{ secrets.NPM_TOKEN }}
+          access: public
+          package: float_npm_package_${{ env.NPM_VERSION }}.tgz
+      # Cargo publish
+      - name: Publish to crates.io
+        if: ${{ steps.cargo.outputs.changed == 'true' }}
+        run: nix develop -c cargo publish -p rain-math-float
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+      - name: GitHub Release (npm)
+        if: ${{ steps.npm.outputs.changed == 'true' }}
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: npm-${{ env.NPM_VERSION }}
+          name: NPM Package Release ${{ env.NPM_VERSION }}
+          files: float_npm_package_${{ env.NPM_VERSION }}.tgz
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: GitHub Release (cargo)
+        if: ${{ steps.cargo.outputs.changed == 'true' }}
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: crate-${{ env.CARGO_VERSION }}
+          name: Cargo Crate Release crate-${{ env.CARGO_VERSION }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}