dx(publish): Add Automatic Publish with Provenance

.github/workflows/pipeline.yml

@@ -0,0 +1,27 @@
+name: Pipeline
+
+on:
+  push:
+    branches: [main]
+
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: oven-sh/setup-bun@v1
+
+      - run: bun install
+
+      # update npm for provenance support
+      - run: npm --version && npm install -g npm && npm --version
+
+      - run: bun test
+
+      - run: bun run build
+
+      - name: dry-publish
+        run: cd build && npm publish --provenance --dry-run

.github/workflows/publish.yml

@@ -0,0 +1,31 @@
+name: Publish Package to NPM
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: oven-sh/setup-bun@v1
+
+      - run: bun install
+
+      # update npm for provenance support
+      - run: npm --version && npm install -g npm && npm --version
+
+      # make sure this publish doesn’t break anything
+      - run: bun test
+
+      - run: bun run build
+
+      - name: publish
+        run: cd build && npm publish --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package.json

@@ -62,10 +62,7 @@
 	"scripts": {
 		"build": "rm -rf build && tsc && tsc -p ./tsconfig.treeshake.json && bun run build:copy",
 		"build:copy": "cp package.json build && cp readme.md build && cp license.md build",
-		"clean": "read -p \"Are you sure you want to discard all uncommitted changes? (y/n)\" CONTINUE; if [ \"$CONTINUE\" = \"y\" ]; then git clean -dxf; else exit 1; fi && bun install",
 		"coverage": "bun test --coverage",
-		"custom-publish": "bun run clean && bun run build && bun test && echo \"cd build && npm publish\"",
-		"postpublish": "git tag $(bun repl -p \"require('./package.json').version\") && git push --tags",
 		"test": "bun test",
 		"watch": "bun test --watch"
 	},