Add a tag-driven release workflow that publishes to npm

Publishing from a laptop is blocked by the account's 2FA one-time password,
which cannot be typed into a non-interactive session. An automation or
granular access token stored as the NPM_TOKEN repo secret bypasses the OTP,
so CI can publish where a local `npm publish` cannot.

The job re-runs the full lint/build/test gate rather than trusting an earlier
green run, because a tag can point at any commit. Two guards protect the
registry, which never forgets a bad publish: the tag must match the version in
packages/cli/package.json, and the version must not already exist. It then
repeats the CI packaging smoke test (install the tarball, assert zero runtime
dependencies, run the simulated end-to-end flow) before publishing.

Prerelease versions publish under the "next" dist-tag so a beta cannot become
what a plain `npx etherfind` resolves to.

No --provenance and no OIDC trusted publishing: both require a public
repository and this one is private.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Andreas-Froyland

.github/workflows/release.yml

@@ -0,0 +1,120 @@
+name: Release
+
+# Publishing is gated on a version tag so a release is always a deliberate act
+# with a commit to point at. workflow_dispatch exists to rehearse the whole
+# pipeline (dry_run defaults to true) without touching the registry.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Run every check and pack the tarball, but do not publish"
+        type: boolean
+        default: true
+
+permissions:
+  contents: write # create the GitHub Release and upload the tarball
+
+# Two releases racing each other would fight over the same version number.
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: publish etherfind to npm
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          # Writes an .npmrc pointing at the public registry and binds it to
+          # NODE_AUTH_TOKEN in the publish step. Without registry-url the token
+          # is silently ignored and the publish fails as unauthenticated.
+          registry-url: https://registry.npmjs.org
+
+      - run: npm ci
+
+      # Re-run the full CI gate here rather than trusting an earlier green run:
+      # a tag can point at any commit, including one CI never saw.
+      - run: npm run lint
+      - run: npm run build
+      - run: npm test
+
+      - name: Check the tag matches the package version
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          pkg="$(node -p "require('./packages/cli/package.json').version")"
+          if [ "$tag" != "$pkg" ]; then
+            echo "::error::tag $GITHUB_REF_NAME implies version $tag, but packages/cli/package.json says $pkg"
+            exit 1
+          fi
+          echo "releasing etherfind@$pkg"
+
+      # npm rejects a duplicate version anyway, but it does so *after* the
+      # publish step has already been entered. Failing here keeps the reason
+      # obvious: bump the version, don't retry the same tag.
+      - name: Refuse to republish an existing version
+        run: |
+          pkg="$(node -p "require('./packages/cli/package.json').version")"
+          if npm view "etherfind@$pkg" version >/dev/null 2>&1; then
+            echo "::error::etherfind@$pkg is already on the registry; bump the version first"
+            exit 1
+          fi
+
+      # Same smoke test as the CI packaging job: a missing "files" entry or a
+      # leaked runtime dependency must fail before the publish, not after it,
+      # because a published version can never be replaced.
+      - name: Pack and verify the tarball
+        run: |
+          mkdir -p /tmp/tarballs
+          npm pack --workspace etherfind --pack-destination /tmp/tarballs
+          mkdir -p /tmp/smoke && cd /tmp/smoke
+          npm init -y > /dev/null
+          npm install /tmp/tarballs/etherfind-*.tgz --no-audit --no-fund
+          ./node_modules/.bin/etherfind --version
+          ./node_modules/.bin/etherfind --help
+          node -e "const p=require('/tmp/smoke/node_modules/etherfind/package.json'); if (Object.keys(p.dependencies||{}).length) { console.error('published package must have no runtime dependencies'); process.exit(1); }"
+          ./node_modules/.bin/etherfind --simulate --json | tee run.ndjson
+          grep -q '"event":"final"' run.ndjson
+          grep -q '"ok":true' run.ndjson
+
+      # On a tag push the `inputs` context is empty, so `!inputs.dry_run` is
+      # true and the publish runs. On workflow_dispatch it honours the checkbox.
+      #
+      # NPM_TOKEN must be an *automation* or *granular access* token: those are
+      # the only kinds that bypass the account's 2FA one-time password, which
+      # cannot be entered from CI.
+      #
+      # No --provenance: it requires a public repository, and this repo is
+      # private. Add the flag (plus `id-token: write` above) if that changes.
+      - name: Publish to npm
+        if: ${{ !inputs.dry_run }}
+        run: |
+          pkg="$(node -p "require('./packages/cli/package.json').version")"
+          # A prerelease version must not take the "latest" dist-tag, or every
+          # plain `npx etherfind` would immediately start serving the beta.
+          case "$pkg" in
+            *-*) tag=next ;;
+            *) tag=latest ;;
+          esac
+          echo "publishing etherfind@$pkg under dist-tag $tag"
+          npm publish --workspace etherfind --access public --tag "$tag"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create the GitHub release
+        if: ${{ startsWith(github.ref, 'refs/tags/') && !inputs.dry_run }}
+        run: |
+          pkg="$(node -p "require('./packages/cli/package.json').version")"
+          case "$pkg" in
+            *-*) prerelease=--prerelease ;;
+            *) prerelease= ;;
+          esac
+          gh release create "$GITHUB_REF_NAME" --generate-notes --verify-tag $prerelease /tmp/tarballs/etherfind-*.tgz
+        env:
+          GH_TOKEN: ${{ github.token }}