Publish @korap/cmc-tagger to npm on version tags
Rename package to scoped @korap/cmc-tagger with public publishConfig,
restrict the published tarball to src/ + docs via a files whitelist, and
add a GitHub Actions job that publishes to npm on v* tags using OIDC
trusted publishing (no token, automatic provenance).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Change-Id: Id2b80fd739ae3190f7ef6eb007ddc2c2bc472a3e
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ba0bd50..71d59a1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,3 +62,20 @@
bin/macos/cmc-tagger
bin/win/cmc-tagger.exe
generate_release_notes: true
+
+ publish-npm:
+ needs: test
+ runs-on: ubuntu-latest
+ if: startsWith(github.ref, 'refs/tags/')
+ permissions:
+ id-token: write # required for npm trusted publishing (OIDC)
+ contents: read
+ steps:
+ - uses: actions/checkout@v4
+ - uses: actions/setup-node@v4
+ with:
+ node-version: '22'
+ registry-url: 'https://registry.npmjs.org'
+ - run: npm install -g npm@latest # OIDC/trusted publishing needs npm >= 11.5.1
+ - run: npm ci
+ - run: npm publish # no token: authenticates via OIDC, provenance is automatic