From 8da7afb646e9a84ac859c7e94895144d4419970a Mon Sep 17 00:00:00 2001
From: Daniel Yang <dev@daniel-yang.com>
Date: Fri, 17 Jul 2026 21:57:09 -0700
Subject: [PATCH] Add tag-driven npm release workflow with trusted publishing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pushing a crypto-v* tag runs the full suite, verifies the tag matches
packages/crypto's version, and publishes via npm OIDC trusted
publishing — no stored token, automatic provenance attestations
(publishConfig.provenance now takes effect instead of fighting local
publishes). Requires the one-time Trusted Publisher configuration on
npmjs.com (repo ddyy/pk, workflow release-crypto.yml), documented in
the workflow header.
---
 .github/workflows/release-crypto.yml | 45 ++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 .github/workflows/release-crypto.yml

diff --git a/.github/workflows/release-crypto.yml b/.github/workflows/release-crypto.yml
new file mode 100644
index 0000000..10ee081
--- /dev/null
+++ b/.github/workflows/release-crypto.yml
@@ -0,0 +1,45 @@
+# Publishes @pksuite/crypto to npm via OIDC trusted publishing when a
+# crypto-v* tag is pushed. No npm token is stored anywhere: npmjs.com must
+# list this repo + workflow file as the package's Trusted Publisher
+# (package Settings → Trusted Publisher → GitHub Actions →
+# repository ddyy/pk, workflow release-crypto.yml). With trusted
+# publishing, provenance attestations are generated automatically and
+# publishConfig.provenance takes effect.
+name: Release @pksuite/crypto
+on:
+  push:
+    tags: ["crypto-v*"]
+
+permissions:
+  contents: read
+  id-token: write # OIDC token for npm trusted publishing
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.33.0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+      - run: pnpm install --frozen-lockfile
+      # Full suite, not just the package: pkvault integration is part of
+      # the release bar, same as CI.
+      - run: pnpm test
+      - name: Verify tag matches package version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#crypto-v}"
+          PKG_VERSION="$(node -p "require('./packages/crypto/package.json').version")"
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "tag $TAG_VERSION does not match package.json $PKG_VERSION" >&2
+            exit 1
+          fi
+      # OIDC trusted publishing requires npm >= 11.5.1; runners ship older.
+      - run: npm install -g npm@latest
+      - run: npm publish
+        working-directory: packages/crypto