Clear CodeQL note alerts (ASI + unused local) (#18) #4

	name: Publish to npm

	on:
	push:
	tags:
	- 'v*'
	release:
	types: [published]

	jobs:
	publish:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	# id-token: write is required for BOTH npm Trusted Publishing (OIDC auth
	# to npm — no NPM_TOKEN secret needed) AND npm provenance attestation
	# (signed link between this workflow run + commit SHA → published tarball).
	id-token: write
	steps:
	- name: Checkout code
	uses: actions/checkout@v6

	- name: Setup Node.js
	uses: actions/setup-node@v6
	with:
	node-version-file: '.nvmrc'
	registry-url: 'https://registry.npmjs.org'

	# Trusted Publishing requires npm >= 11.5.1; Node 20 ships with npm 10.x.
	- name: Upgrade npm for Trusted Publishing
	run: npm install -g npm@latest

	- name: Install dependencies
	run: npm ci

	- name: Run lint
	run: npm run lint

	- name: Run tests
	run: npm run test

	- name: Build
	run: npm run build

	# No NODE_AUTH_TOKEN needed — Trusted Publishing exchanges the GitHub
	# OIDC token for a short-lived npm publish token at publish time. The
	# `--provenance` flag is implied under Trusted Publishing but kept
	# explicit for readability.
	- name: Publish to npm
	run: npm publish --access public --provenance

Navigation Menu