Add release npm publish automation

Author: afurm

.github/workflows/release-publish.yml

@@ -0,0 +1,90 @@
+name: Release Publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to publish, for example v0.1.1"
+        required: true
+        type: string
+      dry_run:
+        description: "Run npm publish as a dry run"
+        required: true
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: release-publish-${{ github.event.release.tag_name || inputs.tag }}
+  cancel-in-progress: false
+
+jobs:
+  publish-npm:
+    name: Publish to npm
+    if: github.event_name != 'release' || !github.event.release.prerelease
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          ref: ${{ github.event.release.tag_name || inputs.tag }}
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Verify release tag
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: |
+          node --input-type=module <<'NODE'
+          import { readFileSync } from "node:fs";
+
+          const tag = process.env.RELEASE_TAG?.replace(/^v/, "");
+          const { version } = JSON.parse(readFileSync("package.json", "utf8"));
+
+          if (tag !== version) {
+            console.error(`Release tag ${process.env.RELEASE_TAG} does not match package.json version ${version}.`);
+            process.exit(1);
+          }
+          NODE
+
+      - name: Audit dependencies
+        run: npm audit
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Test
+        run: npm test
+        env:
+          OPENAI_API_KEY: ""
+
+      - name: Build
+        run: npm run build
+        env:
+          OPENAI_API_KEY: ""
+
+      - name: Package smoke
+        run: npm pack --dry-run
+
+      - name: Publish dry run
+        if: github.event_name == 'workflow_dispatch' && inputs.dry_run
+        run: npm publish --access public --dry-run
+
+      - name: Publish to npm
+        if: github.event_name == 'release' || !inputs.dry_run
+        run: npm publish --access public

README.md

@@ -138,6 +138,27 @@ The package starts on `http://127.0.0.1:4141` and stores data in
 `./data/board.db` from the directory where the command is run. Set
 `BOARD_DB_PATH` when you want a fixed database location.
 
+## Release Automation
+
+Publishing a GitHub Release whose tag matches `package.json` publishes the same
+version to npm automatically. For example, release tag `v0.1.1` publishes
+`draftmora@0.1.1`.
+
+One-time npm setup:
+
+1. Open the npm package settings for
+   [`draftmora`](https://www.npmjs.com/package/draftmora).
+2. Add a trusted publisher with GitHub Actions.
+3. Use owner `afurm`, repository `draftmora`, and workflow filename
+   `release-publish.yml`.
+
+The workflow validates dependencies, typecheck, tests, build, and package smoke
+before running `npm publish`.
+
+GitHub's repository sidebar "Packages" section is separate from npm. It only
+shows packages published to GitHub Packages, not packages published to
+npmjs.com.
+
 ## Security Model
 
 Draftmora is designed as a personal, local-first app. The Fastify API binds to