update release config for cross-compilation and trusted-publishing

Author: zawata

.github/workflows/release.yaml

@@ -1,6 +1,10 @@
 name: Build And Release
 
-on: [workflow_dispatch, push]
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
 
 jobs:
   Build:
@@ -75,6 +79,12 @@ jobs:
         with:
           submodules: true
 
+      - name: Update npm
+        run: npm install -g npm@latest
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Download Artifacts
         uses: actions/download-artifact@v3
 
@@ -85,8 +95,26 @@ jobs:
           rm -rf bin-*
           sudo chmod -R +x bin
 
+      - name: Verify Binaries
+        run: |
+          // make sure all binaries are present
+          if [ ! -f bin/dump-syms-linux-x64 ]; then echo "Missing bin/dump-syms-linux-x64" && exit 1; fi
+          if [ ! -f bin/dump-syms-linux-arm64 ]; then echo "Missing bin/dump-syms-linux-arm64" && exit 1; fi
+          if [ ! -f bin/dump-syms-macos-x64 ]; then echo "Missing bin/dump-syms-macos-x64" && exit 1; fi
+          if [ ! -f bin/dump-syms-macos-arm64 ]; then echo "Missing bin/dump-syms-macos-arm64" && exit 1; fi
+          if [ ! -f bin/dump-syms-windows-x64.exe ]; then echo "Missing bin/dump-syms-windows-x64.exe" && exit 1; fi
+          if [ ! -f bin/dump-syms-windows-arm64.exe ]; then echo "Missing bin/dump-syms-windows-arm64.exe" && exit 1; fi
+
+      - name: Verify Version
+        run: |
+          TAG_VERSION=${GITHUB_REF#refs/tags/v}
+          PACKAGE_VERSION=$(node -p "require('./package.json').version")
+          if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then
+            echo "Tag version ($TAG_VERSION) does not match package.json version ($PACKAGE_VERSION)"
+            exit 1
+          fi
+
       # this will only publish if the version has been updated
       - name: NPM Publish
-        uses: JS-DevTools/[email protected]
-        with:
-          token: ${{secrets.NPM_TOKEN}}
+        run: |
+          npm publish