ci: add publish workflow

Author: pi0

.github/workflows/ci.yml

@@ -8,9 +8,6 @@ on:
     branches:
       - main
 
-# permissions:
-#   id-token: write
-
 jobs:
   ci:
     runs-on: ubuntu-latest
@@ -28,15 +25,3 @@ jobs:
       - run: corepack enable
       - run: pnpm install
       - run: pnpm run lint
-      - run: pnpm run build
-
-      - name: nightly release
-        if: github.ref_name == 'main' &&
-          !contains(github.event.head_commit.message, '[skip-release]') &&
-          !startsWith(github.event.head_commit.message, 'docs')
-        run: |
-          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> ~/.npmrc
-          pnpm changelogen --canary nightly --publish
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: false

.github/workflows/publish.yml

@@ -0,0 +1,33 @@
+name: publish
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          fetch-depth: 0
+
+      - run: npm i -fg corepack && corepack enable
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: 'pnpm'
+
+      - run: corepack enable
+      - run: pnpm install
+      - run: pnpm run lint
+      - run: pnpm run build
+      - name: publish
+        run: |
+          pnpm changelogen --canary nightly --bump
+          npm publish