From ae0f62de7cf4920cf91d0a4eed8aed6529e074a4 Mon Sep 17 00:00:00 2001
From: Faraazuddin Mohammed <mohdfaraaz1@gmail.com>
Date: Thu, 7 May 2026 03:13:42 -0400
Subject: [PATCH] ci(release): manual-trigger workflow that publishes both
 packages

Browser-only flow:
1. npmjs.com -> Settings -> Access Tokens -> Generate Granular -> check 'Bypass 2FA' -> Read+Write -> All packages
2. github.com/faraa2m/tokenometer/settings/secrets/actions -> add NPM_TOKEN
3. github.com/faraa2m/tokenometer/actions -> 'release' -> Run workflow

Optionally pass a version input to bump both packages with npm version --workspaces. Provenance attestation enabled via id-token: write + --provenance flag.
---
 .github/workflows/release.yml | 51 +++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..9dfaf2d
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,51 @@
+name: release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to bump to (e.g. 0.0.2). Leave empty to keep current package.json version.'
+        required: false
+        default: ''
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org/'
+      - run: npm ci
+
+      - name: Bump versions (if requested)
+        if: ${{ inputs.version != '' }}
+        run: |
+          npm version ${{ inputs.version }} --no-git-tag-version --workspaces
+
+      - run: npm run build
+      - run: npm test
+      - run: npm run benchmarks
+
+      - name: Publish @tokenometer/core
+        working-directory: packages/core
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish tokenometer (CLI)
+        working-directory: packages/cli
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Summary
+        run: |
+          echo "### Published" >> $GITHUB_STEP_SUMMARY
+          echo "- https://www.npmjs.com/package/@tokenometer/core" >> $GITHUB_STEP_SUMMARY
+          echo "- https://www.npmjs.com/package/tokenometer" >> $GITHUB_STEP_SUMMARY