Prepare workflows for trusted publishing

.github/actions/ci-setup/action.yml

@@ -1,12 +1,19 @@
 name: Setup CI
 
+inputs:
+  node-version:
+    description: "Node.js version"
+    required: false
+    default: 22
+
 runs:
   using: composite
   steps:
-    - name: Setup Node.js
-      uses: actions/setup-node@v4
+    - name: Setup Node.js ${{ inputs.node-version }}
+      uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
       with:
-        node-version-file: ".node-version"
+        node-version: ${{ inputs.node-version }}
+        cache: yarn
 
     - name: Install dependencies
       shell: bash

.github/workflows/publish.yml

@@ -0,0 +1,60 @@
+name: Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "The npm tag to publish to"
+        required: true
+        type: choice
+        options:
+          - latest
+          - test
+
+concurrency: publish
+
+permissions: {} # each job should define its own permission explicitly
+
+jobs:
+  publish:
+    name: Publish
+    if: github.repository == 'Thinkmill/manypkg'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    environment: Release
+    permissions:
+      contents: write # to push tags
+      id-token: write # to use OpenID Connect token for trusted publishing (changesets/action)
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/ci-setup
+        with:
+          node-version: 24
+
+      - run: yarn build
+
+      - name: git config
+        run: |
+          git config --global user.name 'GitHub Actions'
+          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
+
+      - name: version packages
+        if: inputs.tag != 'latest'
+        run: |
+          yarn changeset version --snapshot ${{ inputs.tag }}
+          git commit -a -m 'test'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: npm publish, git tag
+        run: yarn changeset publish --tag ${{ inputs.tag }}
+
+      # reset, then we have a tagged dangling commit
+      - name: git push
+        if: inputs.tag != 'latest'
+        run: |
+          git reset HEAD~1 --hard
+
+      - run: git push origin --tags

.github/workflows/release-pr.yml

@@ -0,0 +1,29 @@
+name: Create Release PR
+
+on:
+  push:
+    branches:
+      - main
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  create-release-pr:
+    name: Create Release PR
+    if: github.repository == 'Thinkmill/manypkg'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: write # to push for release PR (changesets/action)
+      issues: write # to post issue comments (changesets/action)
+      pull-requests: write # to create pull request (changesets/action)
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/ci-setup
+        with:
+          node-version: 24
+
+      - name: "Create Pull Request"
+        uses: changesets/action@v1

package.json

@@ -7,11 +7,11 @@
     "packages/*"
   ],
   "scripts": {
+    "build": "preconstruct build",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "postinstall": "preconstruct dev && NODE_OPTIONS=--experimental-strip-types packages/cli/bin.js check",
     "knip": "knip",
-    "release": "preconstruct build && changeset publish",
     "test": "vitest"
   },
   "devDependencies": {