ci: changesets release pipeline with provenance publishing

.changeset/config.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "changelog": ["@changesets/changelog-github", { "repo": "expilu/smart-decisions" }],
+  "commit": false,
+  "access": "public",
+  "baseBranch": "main"
+}

.changeset/remove-openai-dependency.md

@@ -0,0 +1,6 @@
+---
+'smart-decisions': minor
+---
+
+Removed the `openai` SDK dependency: the library now talks to the OpenAI-compatible
+endpoint with an in-library HTTP transport.

.github/workflows/ci.yml

@@ -0,0 +1,54 @@
+name: CI
+
+# Pull-request pipeline plus the always-on main baseline. Gate list mirrors
+# `prepublishOnly` exactly: CI green here means a release would pass too.
+# Failed tests land as inline annotations pinned to the changed lines; the
+# coverage bot posts a per-PR comment comparing coverage against main.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  code-quality: write # lets github-code-quality[bot] post coverage on the PR
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [22, 24] # engines: >=22 — test the floor and the current LTS
+
+    steps:
+      - uses: actions/checkout@v4
+        # Pin the PR head SHA so coverage line numbers map onto the diff view.
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run format:check
+      - run: npm run typecheck
+      - run: npm run build
+      - run: npm run test:coverage
+
+      - name: Upload coverage for PR comment
+        # Sugar, not a gate: coverage thresholds already fail the job via
+        # test:coverage. Upload hiccups (preview feature) must not block merges.
+        if: >-
+          matrix.node == 22 &&
+          github.event_name == 'pull_request' &&
+          !github.event.pull_request.head.repo.fork
+        uses: actions/upload-code-coverage@v1
+        with:
+          file: coverage/cobertura-coverage.xml
+          language: JavaScript
+          label: code-coverage/vitest
+          fail-on-error: false

.github/workflows/release.yml

@@ -0,0 +1,51 @@
+name: Release
+
+# Two modes, decided by changesets/action:
+#  - pending changesets on main -> opens/updates the "Version Packages" PR
+#    (bumps package.json, rewrites CHANGELOG.md, syncs src/version.ts)
+#  - no pending changesets (a Version Packages PR was just merged)
+#    -> builds, publishes to npm with provenance (OIDC trusted publishing,
+#    no stored token), tags vX.Y.Z, creates the GitHub release from the
+#    CHANGELOG.md section.
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write # tag + GitHub release + Version Packages PR
+  pull-requests: write # Version Packages PR
+  id-token: write # npm trusted publishing (OIDC)
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      # npm >= 11.5 is required for OIDC trusted publishing.
+      - run: npm i -g npm@11
+
+      - run: npm ci
+
+      - uses: changesets/action@v1
+        id: changesets
+        with:
+          version: npx changeset version && node ./scripts/sync-version.mjs
+          publish: node ./scripts/release.mjs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Tag and create GitHub release
+        if: steps.changesets.outputs.published == 'true'
+        run: node ./scripts/github-release.mjs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}