ci: add manual npm publish workflow

Author: e.khalilov

.github/workflows/publish.yml

@@ -0,0 +1,120 @@
+name: Publish (manual)
+
+env:
+  DEBUG: napi:*
+  APP_NAME: usb-hotplug
+  MACOSX_DEPLOYMENT_TARGET: "10.13"
+
+on:
+  workflow_dispatch:
+    inputs:
+      npm_tag:
+        description: "npm dist-tag"
+        required: true
+        default: "latest"
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        settings:
+          - host: macos-latest
+            target: aarch64-apple-darwin
+            build: npx napi build --platform --release --target aarch64-apple-darwin --js-package-name @e-khalilov/usb-hotplug
+          - host: macos-latest
+            target: x86_64-apple-darwin
+            build: npx napi build --platform --release --target x86_64-apple-darwin --js-package-name @e-khalilov/usb-hotplug
+          - host: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            build: npx napi build --platform --release --target x86_64-unknown-linux-gnu --use-napi-cross --js-package-name @e-khalilov/usb-hotplug
+          - host: windows-latest
+            target: x86_64-pc-windows-msvc
+            build: npx napi build --platform --release --target x86_64-pc-windows-msvc --js-package-name @e-khalilov/usb-hotplug
+
+    name: Build ${{ matrix.settings.target }}
+    runs-on: ${{ matrix.settings.host }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.settings.target }}
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build
+        run: ${{ matrix.settings.build }}
+        shell: bash
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: bindings-${{ matrix.settings.target }}
+          path: ${{ env.APP_NAME }}.*.node
+          if-no-files-found: error
+
+  publish:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    needs:
+      - build
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - name: Install latest npm
+        run: npm install -g npm@latest
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Move artifacts into npm/*
+        run: npx napi artifacts
+
+      - name: List packages
+        run: ls -R ./npm
+        shell: bash
+
+      - name: Publish (unconditional)
+        run: |
+          set -u
+          TAG="${{ github.event.inputs.npm_tag }}"
+          echo "Publishing with dist-tag: $TAG"
+
+          # Publish each platform package explicitly.
+          for dir in npm/*/; do
+            echo "==> Publishing $dir"
+            if npm publish "$dir" --access public --provenance --tag "$TAG"; then
+              echo "published $dir"
+            else
+              echo "skip $dir (already published or no-op)"
+            fi
+          done
+
+          # Publish the root package. --ignore-scripts bypasses the
+          # prepublishOnly (napi prepublish) hook entirely.
+          echo "==> Publishing root package"
+          npm publish --access public --provenance --tag "$TAG" --ignore-scripts
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true