Publish to npm as fulldev with Changesets and trusted publishing

.changeset/README.md

@@ -0,0 +1,5 @@
+# Changesets
+
+The Fulldev CLI uses Changesets to version and publish the `fulldev` npm package.
+Add a changeset with `pnpm changeset` in every pull request that changes what
+users get. Merging to main opens a release pull request; merging that publishes.

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@2.3.0/schema.json",
+  "changelog": ["@changesets/changelog-github", { "repo": "fulldotdev/cli" }],
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.github/workflows/release.yml

@@ -0,0 +1,72 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions: {}
+
+# Installs, also nested ones in scripts, skip pnpmfiles. Dependency scripts are skipped
+# on the install below; the env leaves them on so publishing keeps its lifecycle scripts.
+env:
+  pnpm_config_ignore_pnpmfile: "true"
+
+jobs:
+  release-pr:
+    name: Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      pull-requests: write
+
+    steps:
+      # A GitHub App token instead of GITHUB_TOKEN, so the release pull request
+      # triggers the organization Check like any other pull request.
+      - name: Create release token
+        id: token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          fetch-depth: 0
+          token: ${{ steps.token.outputs.token }}
+          # Keep the token out of .git/config during the install; Changesets
+          # pushes through the GitHub API instead (commitMode below).
+          persist-credentials: false
+
+      - name: Setup PNPM
+        # v6.1.0 is the first release that installs pnpm 12; the v6 tag still points to 6.0.10.
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+
+      - name: Setup Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version-file: .node-version
+          registry-url: https://registry.npmjs.org
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+
+      - name: Create release pull request
+        id: changesets
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        with:
+          version: pnpm release
+          publish: pnpm release:publish
+          commit: "[ci] release"
+          title: "[ci] release"
+          # Commits and tags go through the GitHub API with the App token, signed
+          # and attributed to the App, so no Git credential is needed in the checkout.
+          commitMode: github-api
+        env:
+          GITHUB_TOKEN: ${{ steps.token.outputs.token }}

README.md

@@ -4,17 +4,17 @@ Edit your website through the [Fulldev CMS](https://cms.full.dev) from a termina
 
 ## Install
 
-Run it straight from GitHub. It needs Node.js 24 or later.
+Run it from npm. It needs Node.js 24 or later.
 
 ```sh
-npx -y github:fulldotdev/cli help
-pnpm dlx github:fulldotdev/cli help
+npx -y fulldev help
+pnpm dlx fulldev help
 ```
 
 Or install it once:
 
 ```sh
-npm install -g github:fulldotdev/cli
+npm install -g fulldev
 fulldev help
 ```
 
@@ -79,3 +79,7 @@ pnpm build   # writes dist/cli.mjs
 ## License
 
 [MIT](LICENSE)
+
+## Releases
+
+Every pull request that changes what users get adds a changeset with `pnpm changeset`. Merging to `main` opens a release pull request; merging that publishes the [`fulldev` package](https://www.npmjs.com/package/fulldev) to npm from GitHub Actions with trusted publishing and provenance, without an npm token. `dist/` stays committed, so `npx github:fulldotdev/cli` keeps working; `pnpm check` fails when it is out of date.

package.json

@@ -18,9 +18,11 @@
   "scripts": {
     "build": "vp pack",
     "dev": "vp pack --watch",
-    "check": "vp check && vp test",
+    "check": "vp check && vp test && pnpm build && git diff --exit-code -- dist",
     "fix": "vp check --fix",
-    "test": "vp test"
+    "test": "vp test",
+    "release": "changeset version && pnpm install --lockfile-only",
+    "release:publish": "pnpm build && git diff --exit-code -- dist && changeset publish"
   },
   "packageManager": "pnpm@12.8.1",
   "engines": {
@@ -30,9 +32,26 @@
     "@modelcontextprotocol/client": "^2.3.0"
   },
   "devDependencies": {
+    "@changesets/changelog-github": "^0.7.0",
+    "@changesets/cli": "^2.31.1",
     "@types/node": "^24.19.1",
     "typescript": "^6.0.3",
     "vite-plus": "1.0.0"
   },
-  "author": "Fulldev"
+  "author": "Fulldev",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "homepage": "https://github.com/fulldotdev/cli#readme",
+  "bugs": {
+    "url": "https://github.com/fulldotdev/cli/issues"
+  },
+  "keywords": [
+    "fulldev",
+    "cms",
+    "mcp",
+    "cli",
+    "agent-skills"
+  ]
 }