docs(docker): count-free image description — counts live in README/se… #79

	name: Release
	on:
	push:
	branches:
	- main

	jobs:
	release:
	name: Release
	runs-on: ubuntu-latest
	# npm publishes via OIDC trusted publishing (no tokens) — same config as the
	# proven force-release.yml. contents/pull-requests are for the changesets
	# version PR.
	permissions:
	id-token: write
	contents: write
	pull-requests: write
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Install Node.js
	uses: actions/setup-node@v4
	with:
	node-version: 22
	registry-url: "https://registry.npmjs.org"

	# npm OIDC trusted publishing requires npm >= 11.5.1; Node 22 bundles npm 10.x,
	# which signs provenance but cannot do the trusted-publishing token exchange
	# (publish then fails with E404-on-PUT).
	- name: Upgrade npm for trusted publishing
	run: npm install -g npm@latest && npm --version

	- name: Install dependencies
	run: yarn install

	- name: Create Release Pull Request
	id: changesets
	uses: changesets/action@v1
	with:
	version: yarn run changeset:version
	title: 'chore: release'
	commit: 'chore: release'
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Publish
	if: steps.changesets.outputs.hasChangesets == 'false'
	run: yarn run publish
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	# OIDC trusted publishing was never configured on npmjs.com, so every
	# tokenless publish fails E404-on-PUT (provenance signs, PUT rejects).
	# NODE_AUTH_TOKEN feeds the .npmrc written by setup-node's registry-url.
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
	NPM_CONFIG_PROVENANCE: true

Navigation Menu