ci: publish to npm from a GitHub workflow

[agoldis]

Adds a "Publish NPM Package" workflow so @currents/commit-info is published from GitHub, like @currents/cmd and @currents/playwright. Today it is published by hand with npm publish.

• Manual workflow_dispatch with an npm tag: alpha, beta or latest. alpha and beta need a matching -alpha.N / -beta.N version, and latest rejects any prerelease.
• Two jobs. test checks the version, installs dependencies and runs the unit tests, with read-only permissions. publish runs after it and is the only job with id-token: write. It runs checkout, setup-node and npm publish --ignore-scripts, and no dependency code, since the package has no build step.
• Authenticates with npm trusted publishing (OIDC), so no npm token is stored in the repo.

workflow_dispatch only works for a workflow on the default branch, so this needs to merge before #9 can publish its beta.

Before the first run, @currents/commit-info needs a trusted publisher on npmjs.com (package settings → Trusted Publisher → GitHub Actions): organization currents-dev, repository commit-info, workflow publish.yaml.

Not run yet: it can only run after merge.

Refs ENG-934

🤖 Generated with Claude Code

https://claude.ai/code/session_01LdJrRhBLEH9Uwt97JMGVTR

Summary by CodeRabbit

• Chores
  • Package releases can now be published through a manually triggered release process, with alpha, beta, or latest channels available.
  • Release versions are checked against the selected channel, and unit tests run before publication. mismatches prevent the release from proceeding.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 31bdfd89-6cac-401c-b3be-468288c5e0f4

📥 Commits

Reviewing files that changed from the base of the PR and between 80ffa78 and 32984cc.

📒 Files selected for processing (1)

• .github/workflows/publish.yaml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[agoldis]

@baz review

[baz-reviewer]

Baz Summary

Add a manually triggered GitHub Actions workflow to validate, test, and publish @currents/commit-info to npm. Use channel-specific version checks and npm trusted publishing via OIDC, with test and publish jobs isolating release permissions.

Topics

Topic	Details
Release validation	Add a manual release flow supporting alpha, beta, and latest, validating package versions and running unit tests before publication. Modified files (1) .github/workflows/publish.yaml Latest Contributors(1) User Commit Date agoldis@gmail.com ci: match the whole ve... September 23, 2026
Trusted npm publish	Publish the package through npm trusted publishing with OIDC, restricting id-token: write permission to the dependent publish job. Modified files (1) .github/workflows/publish.yaml Latest Contributors(1) User Commit Date agoldis@gmail.com ci: match the whole ve... September 23, 2026

  _{Activate to get a short verdict whether this PR is good to go or not}

  _{Activate Skill Maintainer to keep your skills up to date}

  _{This PR would have been improved with Baz Planner - Try it now}