* Publish to npm on merges to main via trusted publishing
Each push to main takes the latest published version, bumps the patch
level, publishes with npm trusted publishing (OIDC, no token), and tags
the commit.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Rename to @determinate-systems/detsys-ts and stop committing dist/
dist/ was in git only so that github: dependents could resolve main.
A prepare script builds on install instead, and npm publish builds from
source.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Pin Netlify to Node 24
Netlify defaults to Node 18.
tsdown needs styleText from node:util, which is Node 20 and later.
* Release with a bump pull request
A merge to main opens a pull request that increments the patch level.
The merge of that pull request publishes to npm and makes the tag.
package.json holds the version, and npm says if it is a release or not.
* Fixup the injection
* Only publish from main
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Check the release tag before opening the next bump PR
A missing tag means npm and the repository do not agree.
Fail so a person can reconcile them.
* Update downstream repos from the release workflow
A tag push from GITHUB_TOKEN does not start a workflow.
The downstream update is now a job after the publish, in the same run.
This removes the need for a PAT or a workflow_dispatch hop.
* Scope GH_TOKEN to the fork step
The update and build steps do not need it.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>