From e9aae2d46bb3e717456fc12a30e830ff39207969 Mon Sep 17 00:00:00 2001
From: Jure Rotar <jrotar0@gmail.com>
Date: Tue, 8 Sep 2026 11:08:52 +0200
Subject: [PATCH 1/2] feat: updated release workflow to automatically create a
 tag & release

---
 .github/workflows/publish.yml | 78 ++++++++++++++++++++++++++++++++---
 1 file changed, 73 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 99b4a34..7cca7aa 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,28 +1,82 @@
 name: Publish package
 
 on:
-  release:
-    types: [published]
   workflow_dispatch:
 
 permissions: {}
 
 jobs:
   publish-npm:
-    name: Publish to npm (OIDC)
+    name: Publish release to npm (OIDC)
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       id-token: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
 
       - name: Setup environment (node + install)
         uses: ./.github/actions/node-setup
         with:
           node-version: 24
 
+      - name: Read package metadata
+        id: package
+        shell: bash
+        run: |
+          set -euo pipefail
+          name="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).name")"
+          version="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version")"
+
+          if [[ -z "${name}" || -z "${version}" ]]; then
+            echo "package.json must define both name and version." >&2
+            exit 1
+          fi
+
+          echo "name=${name}" >> "${GITHUB_OUTPUT}"
+          echo "version=${version}" >> "${GITHUB_OUTPUT}"
+          echo "tag_name=${version}" >> "${GITHUB_OUTPUT}"
+
+      - name: Ensure workflow is running on the default branch
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ "${GITHUB_REF_TYPE}" != "branch" || "${GITHUB_REF_NAME}" != "${DEFAULT_BRANCH}" ]]; then
+            echo "Releases must be published from ${DEFAULT_BRANCH}; this run is using ${GITHUB_REF_NAME}." >&2
+            exit 1
+          fi
+
+      - name: Ensure package version is releasable
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PACKAGE_NAME: ${{ steps.package.outputs.name }}
+          VERSION: ${{ steps.package.outputs.version }}
+          TAG_NAME: ${{ steps.package.outputs.tag_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if git ls-remote --exit-code --tags origin "refs/tags/${TAG_NAME}" >/dev/null 2>&1; then
+            echo "Tag ${TAG_NAME} already exists." >&2
+            exit 1
+          fi
+
+          if gh release view "${TAG_NAME}" >/dev/null 2>&1; then
+            echo "Release ${TAG_NAME} already exists." >&2
+            exit 1
+          fi
+
+          if npm view "${PACKAGE_NAME}@${VERSION}" version >/dev/null 2>&1; then
+            echo "Package ${PACKAGE_NAME}@${VERSION} is already published to npm." >&2
+            exit 1
+          fi
+
       - name: Build and validate package
         run: npm run prepublishOnly
 
@@ -34,4 +88,18 @@ jobs:
           registry-url: https://registry.npmjs.org
 
       - name: Publish to npm
-        run: npm publish --provenance --access public
+        run: npm publish --provenance --access public --tag latest
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PACKAGE_NAME: ${{ steps.package.outputs.name }}
+          VERSION: ${{ steps.package.outputs.version }}
+          TAG_NAME: ${{ steps.package.outputs.tag_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          gh release create "${TAG_NAME}" \
+            --target "${GITHUB_SHA}" \
+            --title "${TAG_NAME}" \
+            --notes "Published ${PACKAGE_NAME}@${VERSION} to npm."

From d9496dc6ff541beae0c2d6a8be8ea8919a8eaba3 Mon Sep 17 00:00:00 2001
From: Jure Rotar <jrotar0@gmail.com>
Date: Tue, 8 Sep 2026 11:12:10 +0200
Subject: [PATCH 2/2] fix: added explanatory comments

---
 .github/workflows/publish.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7cca7aa..0aeaa98 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -10,7 +10,9 @@ jobs:
     name: Publish release to npm (OIDC)
     runs-on: ubuntu-latest
     permissions:
+      # Needed to create the GitHub release and its package-version tag.
       contents: write
+      # Needed by npm trusted publishing to mint an OIDC token.
       id-token: write
     steps:
       - name: Checkout repo