ci: setup trusted publishing

.github/workflows/publish.yml

@@ -0,0 +1,38 @@
+name: Publish Package
+
+on:
+  push:
+    tags:
+      - "v*" # Push events to matching v*, i.e. v1.0, v20.15.10
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    environment: Release
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: pnpm/action-setup@v4
+
+      - name: Set node version to 22
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org/
+          # disable cache, to avoid cache poisoning (https://docs.zizmor.sh/audits/#cache-poisoning)
+          package-manager-cache: false
+          cache: "pnpm"
+
+      - name: Disallow installation scripts
+        run: yq '.onlyBuiltDependencies = []' -i pnpm-workspace.yaml
+
+      - name: Install deps
+        run: pnpm install
+        env:
+          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+
+      - name: Publish package
+        run: npm i -g npm@^11.5.2 && pnpm run ci-publish ${{ github.ref_name }}

package.json

@@ -28,7 +28,7 @@
     "test": "vitest run",
     "format": "prettier --write --cache .",
     "release": "tsx -C import scripts/release.ts",
-    "changelog": "conventional-changelog -p angular -i CHANGELOG.md -s"
+    "ci-publish": "tsx scripts/publishCI.ts"
   },
   "engines": {
     "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
@@ -47,14 +47,11 @@
   },
   "devDependencies": {
     "@types/node": "^24.10.4",
-    "conventional-changelog-cli": "^5.0.0",
-    "enquirer": "^2.4.1",
+    "@vitejs/release-scripts": "^1.6.0",
     "execa": "^9.6.1",
-    "minimist": "^1.2.8",
     "node-forge": "^1.3.3",
     "picocolors": "^1.1.1",
     "prettier": "^3.7.4",
-    "semver": "^7.7.3",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "unbuild": "^3.6.1",