ci: deploy typing to npm and JSR from GitHub Releases

.github/workflows/release.yml

@@ -1,67 +1,58 @@
+# npm Trusted Publisher: nlibjs / typing / release.yml; environment empty.
+# Release and recovery: https://github.com/nlibjs/actions#release-procedure
+name: Release
 on:
-  push:
-    branches: [main]
-    paths: [package.json]
+  release:
+    types: [published]
   workflow_dispatch:
-concurrency: release
+    inputs:
+      action:
+        description: Operation
+        type: choice
+        options: [verify, stage]
+        default: verify
+        required: true
+      tag:
+        description: "Published Release tag for retry, e.g. v1.2.3"
+        type: string
+        default: ""
+permissions:
+  contents: read
+concurrency:
+  group: release-${{ github.event.release.tag_name || inputs.tag || github.ref }}
+  cancel-in-progress: false
 jobs:
-  Release:
-    runs-on: ubuntu-latest
+  Verify:
+    if: github.event_name == 'workflow_dispatch' && inputs.action == 'verify'
     permissions:
-      contents: write # create the tag and the GitHub Release
-      id-token: write # npm Trusted Publishing
-    outputs:
-      released: ${{ steps.version.outputs.released }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - id: version
-        run: |
-          tag="v$(node -p 'require("./package.json").version')"
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-          if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
-            echo "released=true" >> "$GITHUB_OUTPUT"
-          fi
-      - if: steps.version.outputs.released != 'true'
-        uses: actions/setup-node@v7
-        with:
-          node-version: 26.x
-          package-manager-cache: false
-          registry-url: https://registry.npmjs.org
-      - if: steps.version.outputs.released != 'true'
-        run: npm install --global npm@11.21.0
-      - if: steps.version.outputs.released != 'true'
-        run: npm ci
-      - if: steps.version.outputs.released != 'true'
-        run: npm run build
-      # Trusted Publishing (OIDC); a maintainer approves the staged version on npmjs.com.
-      - if: steps.version.outputs.released != 'true'
-        run: |
-          name=$(node -p 'require("./package.json").name')
-          version=$(node -p 'require("./package.json").version')
-          npm view "$name@$version" version >/dev/null 2>&1 || npm stage publish --provenance
-      - if: steps.version.outputs.released != 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ steps.version.outputs.tag }}
-        run: |
-          awk -v h="## $TAG " 'index($0,h)==1{f=1;next} /^## v/{if(f)exit} f' CHANGELOG.md > notes.md
-          gh release create "$TAG" --target "$GITHUB_SHA" --title "$TAG" --notes-file notes.md
+      contents: read
+    uses: nlibjs/actions/.github/workflows/npm-release.yml@53324e92eb61920ce5d274a42eb23f73dd98a383
+    with:
+      action: verify
+  Stage:
+    if: (github.event_name == 'release' && !github.event.release.prerelease) || inputs.action == 'stage'
+    permissions:
+      contents: read
+      actions: read
+      id-token: write
+    uses: nlibjs/actions/.github/workflows/npm-release.yml@53324e92eb61920ce5d274a42eb23f73dd98a383
+    with:
+      action: stage
+      tag: ${{ github.event.release.tag_name || inputs.tag }}
   PublishJsr:
-    needs: Release
-    if: needs.Release.outputs.released != 'true'
+    needs: Stage
     runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 26.x
-          cache: npm
-          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
       - run: npm ci
-      - run: npm run build
-      - run: npx jsr publish
+      - run: npx --yes jsr@0.14.3 publish

package.json

@@ -219,7 +219,8 @@
 		"version:changelog": "npx @nlib/changelog --output CHANGELOG.md",
 		"version:add-changelog": "git add CHANGELOG.md",
 		"version:sync-version": "node cli/sync-version.ts",
-		"version:add-jsr": "git add jsr.json"
+		"version:add-jsr": "git add jsr.json",
+		"release:prepare": "npm run build && git diff --exit-code -- src"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.5.4",