Refactor CI/CD: Use GitHub Releases for publishing, add separate test workflow

.github/workflows/publish-npm.yml

@@ -1,53 +1,54 @@
 name: Publish to NPM
 
 on:
-  workflow_dispatch:
-  push:
-    tags:
-      - 'v*'
+  release:
+    types: [published]
 
 permissions:
-  id-token: write
+  id-token: write  # Required for OIDC
   contents: read
 
 jobs:
   publish-to-npm:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Setup Go
         uses: actions/setup-go@v5
+        with:
+          go-version-file: deadmanswitch/go.mod
+          cache-dependency-path: deadmanswitch/go.sum
 
       - name: Install UPX
         run: sudo apt-get install -y upx
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
-          version: 10
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+          standalone: true
+          cache: true
 
-      - name: Build TypeScript
-        run: pnpm exec kubik ./build.mjs
-
-      - name: Build deadmanswitch
-        run: bash deadmanswitch/build.sh
-
-      - name: Pull docker container
-        run: docker pull postgres:latest
+      - name: Build
+        run: |
+          pnpm i --frozen-lockfile
+          pnpm build
+          pnpm build:deadmanswitch
 
       - name: Make sure tests pass before publishing
-        run: pnpm exec playwright test
-
-      - name: Publish to NPM
-        run: pnpm publish --provenance --no-git-checks
+        run: |
+          docker pull postgres:latest
+          pnpm test
+
+      - name: Publish
+        run: |
+          VERSION=${GITHUB_REF_NAME#v}
+
+          if [[ "$VERSION" == *"-"* ]]; then
+            echo "Publishing prerelease to @next"
+            pnpm publish --access=public --no-git-checks --tag next
+          else
+            echo "Publishing stable to @latest"
+            pnpm publish --access=public --no-git-checks
+          fi

.github/workflows/tests.yml

@@ -0,0 +1,37 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: deadmanswitch/go.mod
+          cache-dependency-path: deadmanswitch/go.sum
+
+      - name: Install UPX
+        run: sudo apt-get install -y upx
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        with:
+          standalone: true
+          cache: true
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build
+      - run: pnpm build:deadmanswitch
+      - run: docker pull postgres:latest
+      - run: pnpm test

README.md

@@ -101,13 +101,35 @@ There are also some notable differences in API design philosophy:
 - **Container Pulling**: PodKeeper does not implicitly pull containers, requiring them to be available beforehand, whereas TestContainers lazily pulls containers as needed when launching a service.
 - **Healthchecks**: The services that PodKeeper ships out-of-the-box are pre-configured to use proper healthchecks.
 
-## Publishing
+## Development
 
-To publish a new version:
+Requires [pnpm](https://pnpm.io/) 11. pnpm installs the Node.js version pinned in `devEngines` in `package.json`.
 
 ```sh
-pnpm version minor -m "chore: mark v%s"  # or: pnpm version patch -m "chore: mark v%s"
-git push --tags upstream main
+pnpm install
+pnpm build                # TypeScript
+pnpm build:deadmanswitch  # Go binaries; needs Go and UPX
+pnpm test                 # needs Docker and `docker pull postgres:latest`
 ```
 
-The GitHub Actions workflow will automatically build and publish to npm when the tag is pushed.
+## Releasing
+
+1. Bump the version:
+
+   ```sh
+   # For a stable minor release
+   pnpm version minor
+
+   # For an alpha pre-release
+   pnpm version preminor --preid=alpha
+   ```
+
+2. Push the commit and tag:
+
+   ```sh
+   git push --follow-tags
+   ```
+
+3. [Create a GitHub Release](https://github.com/flakiness/podkeeper/releases/new) for the new tag and publish it.
+
+   CI will handle publishing to npm. Pre-releases are published under the `@next` tag.

package.json

@@ -2,6 +2,7 @@
   "name": "podkeeper",
   "type": "module",
   "version": "0.8.0",
+  "packageManager": "pnpm@11.5.0",
   "description": "",
   "exports": {
     ".": {
@@ -12,7 +13,9 @@
   },
   "main": "index.js",
   "scripts": {
-    "test": "npx playwright test"
+    "build": "kubik ./build.mjs",
+    "build:deadmanswitch": "bash deadmanswitch/build.sh",
+    "test": "playwright test"
   },
   "repository": {
     "type": "git",
@@ -22,6 +25,16 @@
   "keywords": [],
   "author": "",
   "license": "MIT",
+  "engines": {
+    "node": ">=22"
+  },
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": "^24.21.0",
+      "onFail": "download"
+    }
+  },
   "devDependencies": {
     "@playwright/test": "^1.58.2",
     "@types/ms": "^0.7.34",

pnpm-workspace.yaml

@@ -1,2 +1,4 @@
+allowBuilds:
+  esbuild: true
 onlyBuiltDependencies:
   - esbuild