Automated release publishing

.github/workflows/publish-next.yml

@@ -1,5 +1,8 @@
 name: Publish Next
 
+permissions:
+  id-token: write
+
 on: workflow_dispatch
 
 jobs:
@@ -15,12 +18,12 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: 18.x
-          registry-url: 'https://registry.npmjs.org'
+          registry-url: "https://registry.npmjs.org"
 
       - name: Use Python 3.11
         uses: actions/setup-python@v4
         with:
-          python-version: '3.11'
+          python-version: "3.11"
 
       - name: Install
         shell: bash
@@ -36,4 +39,5 @@ jobs:
         run: |
           yarn publish:next
         env:
+          NPM_CONFIG_PROVENANCE: "true"
           NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}

.github/workflows/publish-release.yml

@@ -0,0 +1,45 @@
+name: Publish Release
+
+permissions:
+  id-token: write
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    name: Perform Publishing
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Use Node.js 18.x
+        uses: actions/setup-node@v3
+        with:
+          node-version: 18.x
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Use Python 3.11
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.11"
+
+      - name: Install
+        shell: bash
+        run: |
+          yarn global add node-gyp
+          yarn --skip-integrity-check --network-timeout 100000
+        env:
+          NODE_OPTIONS: --max_old_space_size=4096
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # https://github.com/microsoft/vscode-ripgrep/issues/9
+
+      - name: Publish NPM
+        shell: bash
+        run: |
+          yarn publish:latest
+        env:
+          NPM_CONFIG_PROVENANCE: "true" # enable provenance check
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}