fix(release): require npm 11.5.1 and publish before release (#5)

Author: AmanVarshney01

.github/workflows/publish.yml

@@ -61,26 +61,20 @@ jobs:
             echo "exists=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Create and push git tag
-        if: steps.check-version.outputs.exists == 'false'
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          if ! git rev-parse "v$VERSION" >/dev/null 2>&1; then
-            git config --local user.email "github-actions[bot]@users.noreply.github.com"
-            git config --local user.name "github-actions[bot]"
-            git tag -a "v$VERSION" -m "Release v$VERSION"
-            git push origin "v$VERSION"
-          else
-            echo "Tag v$VERSION already exists, skipping"
-          fi
-
       - name: Setup Node.js
         if: steps.check-version.outputs.exists == 'false'
         uses: actions/setup-node@v4
         with:
           node-version: "22.14.0"
           registry-url: "https://registry.npmjs.org"
 
+      - name: Ensure npm version for trusted publishing
+        if: steps.check-version.outputs.exists == 'false'
+        run: |
+          npm install -g npm@11.5.1
+          echo "Node: $(node --version)"
+          echo "npm: $(npm --version)"
+
       - name: Setup Bun
         if: steps.check-version.outputs.exists == 'false'
         uses: oven-sh/setup-bun@v2
@@ -91,18 +85,6 @@ jobs:
         if: steps.check-version.outputs.exists == 'false'
         run: bun install --frozen-lockfile
 
-      - name: Create GitHub Release
-        if: steps.check-version.outputs.exists == 'false'
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          if ! gh release view "v$VERSION" >/dev/null 2>&1; then
-            bunx changelogithub
-          else
-            echo "Release v$VERSION already exists, skipping"
-          fi
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Typecheck
         if: steps.check-version.outputs.exists == 'false'
         run: bun run typecheck
@@ -115,6 +97,31 @@ jobs:
         if: steps.check-version.outputs.exists == 'false'
         run: npm publish --access public
 
+      - name: Create and push git tag
+        if: steps.check-version.outputs.exists == 'false'
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          if ! git rev-parse "v$VERSION" >/dev/null 2>&1; then
+            git config --local user.email "github-actions[bot]@users.noreply.github.com"
+            git config --local user.name "github-actions[bot]"
+            git tag -a "v$VERSION" -m "Release v$VERSION"
+            git push origin "v$VERSION"
+          else
+            echo "Tag v$VERSION already exists, skipping"
+          fi
+
+      - name: Create GitHub Release
+        if: steps.check-version.outputs.exists == 'false'
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          if ! gh release view "v$VERSION" >/dev/null 2>&1; then
+            bunx changelogithub
+          else
+            echo "Release v$VERSION already exists, skipping"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Release summary
         if: steps.check-version.outputs.exists == 'false'
         run: |