chore: add trusted publishing release workflow

Author: marian2js

.github/workflows/release.yml

@@ -0,0 +1,47 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.17.0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Verify package version matches tag
+        run: |
+          PACKAGE_VERSION=$(node -p "require('./packages/skill-doctor/package.json').version")
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+
+          if [ "$PACKAGE_VERSION" != "$TAG_VERSION" ]; then
+            echo "Tag version ($TAG_VERSION) does not match package version ($PACKAGE_VERSION)."
+            exit 1
+          fi
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm lint
+      - run: pnpm typecheck
+      - run: pnpm test
+      - run: pnpm release:check
+
+      - name: Publish to npm
+        working-directory: packages/skill-doctor
+        run: npm publish

package.json

@@ -15,6 +15,7 @@
     "lint:fix": "oxlint --fix packages/skill-doctor/src packages/skill-doctor/tests",
     "format": "oxfmt --write .",
     "format:check": "oxfmt --check .",
+    "release:check": "pnpm --filter skill-doctor build && cd packages/skill-doctor && npm pack --dry-run",
     "test": "pnpm -r test",
     "typecheck": "pnpm -r typecheck"
   },

packages/skill-doctor/package.json

@@ -35,9 +35,13 @@
       "default": "./dist/index.js"
     }
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
     "dev": "tsdown --watch",
     "build": "rm -rf dist && NODE_ENV=production tsdown",
+    "pack:check": "npm pack --dry-run",
     "typecheck": "tsc --noEmit",
     "test": "pnpm build && vitest run"
   },