Add publish workflow

Author: aivus

.github/workflows/publish.yml

@@ -0,0 +1,99 @@
+name: Create a tag and publish to npm
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: 'Version bump type'
+        type: choice
+        required: true
+        default: 'minor'
+        options:
+          - patch
+          - minor
+          - major
+          - premajor
+          - preminor
+          - prepatch
+          - prerelease
+      preid:
+        description: 'Prerelease identifier (see "npm version") for pre* bumps'
+        type: string
+        required: false
+      npmPreTag:
+        description: 'NPM tag used for all pre* bumps'
+        type: string
+        default: 'next'
+        required: false
+      dryRun:
+        description: 'Run in "dry run" mode'
+        type: boolean
+        default: false
+        required: true
+
+permissions:
+  id-token: write
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          # Required to allow push to master without the checks/PR
+          token: ${{ secrets.GH_PUSH_TOKEN }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Update npm
+        run: npm install -g npm@latest
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: List of installed dependencies
+        run: npm ls -a
+
+      - name: Verifying provenance attestations
+        run: npm audit signatures
+
+      - name: Run tests
+        run: npm test
+
+      - name: Bump version and create tag
+        id: bump-version
+        env:
+          PREID_FLAG: ${{ startsWith(inputs.bump, 'pre') && inputs.preid && format('--preid {0}', inputs.preid) || '' }}
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          TAG=$(npm version ${{ github.event.inputs.bump }} $PREID_FLAG -m "Release %s")
+          echo "Created tag: $TAG"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Publish to npm
+        env:
+          DRY_RUN_FLAG: ${{ inputs.dryRun && '--dry-run' || '' }}
+          TAG_FLAG: ${{ startsWith(inputs.bump, 'pre') && format('--tag {0}', inputs.npmPreTag) || ''}}
+        run: npm publish --provenance --access=public $DRY_RUN_FLAG $TAG_FLAG
+
+      - name: Push changes to master
+        if: ${{ !inputs.dryRun }}
+        run: |
+          git push origin master --follow-tags
+
+      - name: Create GitHub Release
+        if: ${{ !inputs.dryRun }}
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.bump-version.outputs.tag }}
+          generate_release_notes: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}