From 4ccbe6b8377fe25fdc2b0f6ce3596e0874a45abd Mon Sep 17 00:00:00 2001
From: Sri Panyam <sri.panyam@gmail.com>
Date: Fri, 23 Oct 2026 08:30:42 -0700
Subject: [PATCH] ci: publish to npm on release tags via trusted publishing

publish-npm.yml calls servicekit's shared npm-publish.yml, which installs
with pnpm, builds, runs this repo's checks and tests, refuses a tarball
with test files, and publishes through npm trusted publishing (no token).
---
 .github/workflows/publish-npm.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/publish-npm.yml

diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
new file mode 100644
index 0000000..a013957
--- /dev/null
+++ b/.github/workflows/publish-npm.yml
@@ -0,0 +1,26 @@
+name: Publish npm
+
+# Publishes notations when a release tag (v*) is pushed, through servicekit's shared
+# workflow, which uses npm trusted publishing (no token). The tag must match
+# package.json's version. Run it by hand (workflow_dispatch, ref = an existing
+# tag) to publish an older tag that has this file.
+#
+# npm side, once:
+#   npx npm@latest trust github notations --repo panyam/notations --file publish-npm.yml --allow-publish
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    uses: panyam/servicekit/.github/workflows/npm-publish.yml@master
+    with:
+      package-manager: pnpm
+      node-version: '22'
+      test-command: pnpm run check:esm && pnpm run lint && pnpm test