ci: add tag-triggered npm publish and GitHub release

- Add v* tag trigger and publish job to CI workflow (runs after all
  checks pass: lint, typecheck, test, build, e2e)
- Add publishConfig.access=public to package.json
- Add .npmrc for commit message format (chore: release v%s)
- Add Releasing section to README

Author: k4m4

.github/workflows/ci.yml

@@ -3,9 +3,14 @@ name: CI
 on:
   push:
     branches: [main]
+    tags: ["v*"]
   pull_request:
     branches: [main]
 
+permissions:
+  contents: write
+  id-token: write
+
 jobs:
   commitlint:
     if: github.event_name == 'pull_request'
@@ -84,3 +89,24 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
       - run: pnpm test:e2e
+
+  publish:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [lint, typecheck, test, build, e2e]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build
+      - run: pnpm publish --provenance --no-git-checks --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - run: gh release create ${{ github.ref_name }} --generate-notes
+        env:
+          GH_TOKEN: ${{ github.token }}

.npmrc

@@ -0,0 +1 @@
+message="chore: release v%s"

README.md

@@ -2018,6 +2018,20 @@ test/
 - Tabs for indentation, double quotes
 - ESM-only (`"type": "module"`)
 
+### Releasing
+
+Releases are tag-triggered. Pushing a semver tag runs all CI checks, publishes to npm with [provenance](https://docs.npmjs.com/generating-provenance-statements), and creates a GitHub release with auto-generated notes.
+
+```bash
+# 1. Bump version
+pnpm version patch   # or minor / major
+
+# 2. Push commit and tag
+git push && git push --tags
+```
+
+CI handles the rest. Requires an `NPM_TOKEN` repository secret.
+
 ## Contributing
 
 Contributions are welcome! Please:

package.json

@@ -31,6 +31,9 @@
 	},
 	"packageManager": "pnpm@10.30.3",
 	"license": "MIT",
+	"publishConfig": {
+		"access": "public"
+	},
 	"files": [
 		"dist"
 	],