ci: release automatically when the package.json version changes on main

.github/workflows/release.yml

@@ -1,25 +1,56 @@
 on:
-  release:
-    types: [published]
+  push:
+    branches: [main]
+    paths: [package.json]
+  workflow_dispatch:
+concurrency: release
 jobs:
-  PublishNpm:
+  Release:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      id-token: write
+      contents: write # create the tag and the GitHub Release
+      id-token: write # npm Trusted Publishing
+    outputs:
+      released: ${{ steps.version.outputs.released }}
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+        with:
+          fetch-depth: 0
+      - id: version
+        run: |
+          tag="v$(node -p 'require("./package.json").version')"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
+            echo "released=true" >> "$GITHUB_OUTPUT"
+          fi
+      - if: steps.version.outputs.released != 'true'
+        uses: actions/setup-node@v7
         with:
           node-version: 26.x
           package-manager-cache: false
           registry-url: https://registry.npmjs.org
-      - run: npm install --global npm@11.21.0
-      - run: npm ci
-      - run: npm run build
-      # Authenticates with npm Trusted Publishing (OIDC); no NPM_TOKEN needed.
-      - run: npm stage publish --provenance
+      - if: steps.version.outputs.released != 'true'
+        run: npm install --global npm@11.21.0
+      - if: steps.version.outputs.released != 'true'
+        run: npm ci
+      - if: steps.version.outputs.released != 'true'
+        run: npm run build
+      # Trusted Publishing (OIDC); a maintainer approves the staged version on npmjs.com.
+      - if: steps.version.outputs.released != 'true'
+        run: |
+          name=$(node -p 'require("./package.json").name')
+          version=$(node -p 'require("./package.json").version')
+          npm view "$name@$version" version >/dev/null 2>&1 || npm stage publish --provenance
+      - if: steps.version.outputs.released != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.version.outputs.tag }}
+        run: |
+          awk -v h="## $TAG " 'index($0,h)==1{f=1;next} /^## v/{if(f)exit} f' CHANGELOG.md > notes.md
+          gh release create "$TAG" --target "$GITHUB_SHA" --title "$TAG" --notes-file notes.md
   PublishJsr:
+    needs: Release
+    if: needs.Release.outputs.released != 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read