From 0ad97bdb48e7ec46ea2d825ace41dbfb6ad4e171 Mon Sep 17 00:00:00 2001
From: Michael Magan <magan@usehydra.ai>
Date: Sat, 22 Aug 2026 12:55:29 -0700
Subject: [PATCH] Add tag-triggered npm release workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Publishes to npm via trusted publishing (OIDC) on a v*.*.* tag push,
after running the same check gate as CI and a real pack/install smoke
test of the tarball. Requires the trusted publisher to be configured on
npmjs.com for tambo-labs/charming-cli + this workflow file before the
first run — npm trusted-publisher config lives on the package's own
settings page and can't be set up from the CLI.

First real publish (usecharming@0.1.0) went out manually with 2FA,
since OIDC trusted publishing can't perform the first publish of a
package name that doesn't exist yet. Every release after that can use
this workflow.
---
 .github/workflows/release.yml | 67 +++++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..5116ec7
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,67 @@
+name: Release
+
+# Publishes to npm on a version tag push. Uses npm trusted publishing
+# (OIDC) instead of a long-lived NPM_TOKEN secret — the trusted publisher
+# must be configured on npmjs.com for this repo + this workflow file
+# before the first run (npmjs.com -> usecharming package -> Settings ->
+# Trusted Publisher). Requires npm CLI >= 11.5.1, hence the explicit
+# `npm install -g npm@latest` below.
+#
+# A tag alone doesn't publish: `bun run check` (the same gate ci.yml
+# runs) must pass, and the tag must match package.json's version.
+
+on:
+  push:
+    tags: ['v*.*.*']
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # create the GitHub Release
+      id-token: write # npm trusted publishing (OIDC)
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v6.0.0
+        with:
+          node-version: 22
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: npm install -g npm@latest
+
+      - run: bun install --frozen-lockfile
+
+      - run: bun run check
+
+      - name: Verify tag matches package.json version
+        run: |
+          pkg=$(node -p "require('./package.json').version")
+          tag="${GITHUB_REF_NAME#v}"
+          if [ "$pkg" != "$tag" ]; then
+            echo "tag v$tag does not match package.json version $pkg" >&2
+            exit 1
+          fi
+
+      - name: Smoke-test the packed tarball
+        run: |
+          tarball=$(npm pack --silent)
+          mkdir -p /tmp/smoke && cd /tmp/smoke && npm init -y >/dev/null
+          npm install "$GITHUB_WORKSPACE/$tarball"
+          ./node_modules/.bin/charming --version
+          ./node_modules/.bin/charming --help
+
+      - run: npm publish
+        # No NODE_AUTH_TOKEN: the trusted publisher on npmjs.com supplies
+        # credentials via OIDC and attaches a provenance attestation.
+
+      - run: gh release create "$GITHUB_REF_NAME" --generate-notes --verify-tag
+        env:
+          GH_TOKEN: ${{ github.token }}