fix(ci): split release.yml into version + publish jobs

Fixes the failed alpha.1 publish (run 23850387096). Two issues:

1. changesets/action passed 'publish: pnpm run build:all && pnpm
   changeset publish' as argv, not through a shell — '&&' became a
   literal arg forwarded to tsdown. Wrapped in package.json ci:publish
   script.

2. NPM_TOKEN is environment-scoped to 'release' but the job had no
   environment. Now the publish job has environment: release.

Split into two jobs so the Version PR auto-updates (ungated) but
publish requires environment approval. The version job's hasChangesets
output gates the publish job.

Also enables provenance (id-token: write + NPM_CONFIG_PROVENANCE).

Author: felixweinberger

.github/workflows/release.yml

@@ -1,9 +1,5 @@
 name: Release
 
-permissions:
-    contents: write
-    pull-requests: write
-
 on:
     push:
         branches:
@@ -12,9 +8,14 @@ on:
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
-    release:
-        name: Release
+    version:
+        name: Version
         runs-on: ubuntu-latest
+        permissions:
+            contents: write
+            pull-requests: write
+        outputs:
+            hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
         steps:
             - uses: actions/checkout@v6
 
@@ -29,17 +30,50 @@ jobs:
                   node-version: 24
                   cache: pnpm
                   cache-dependency-path: pnpm-lock.yaml
-                  registry-url: 'https://registry.npmjs.org'
 
             - name: Install dependencies
               run: pnpm install
 
-            - name: Create Release Pull Request or Publish to npm
+            - name: Create or update Version Packages PR
               id: changesets
+              uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
+
+    publish:
+        name: Publish
+        needs: version
+        if: needs.version.outputs.hasChangesets == 'false'
+        runs-on: ubuntu-latest
+        environment: release
+        permissions:
+            contents: write
+            id-token: write
+        steps:
+            - uses: actions/checkout@v6
+
+            - name: Install pnpm
+              uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+              with:
+                  run_install: false
+
+            - name: Setup Node.js
+              uses: actions/setup-node@v6
+              with:
+                  node-version: 24
+                  cache: pnpm
+                  cache-dependency-path: pnpm-lock.yaml
+                  registry-url: 'https://registry.npmjs.org'
+
+            - name: Install dependencies
+              run: pnpm install
+
+            - name: Publish to npm
               uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1
               with:
-                  publish: pnpm run build:all && pnpm changeset publish
+                  publish: pnpm run ci:publish
               env:
                   GITHUB_TOKEN: ${{ github.token }}
                   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
                   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+                  NPM_CONFIG_PROVENANCE: 'true'

package.json

@@ -29,6 +29,7 @@
         "docs:check": "typedoc",
         "typecheck:all": "pnpm -r typecheck",
         "build:all": "pnpm -r build",
+        "ci:publish": "pnpm run build:all && pnpm changeset publish",
         "prepack:all": "pnpm -r prepack",
         "lint:all": "pnpm sync:snippets --check && pnpm -r lint",
         "lint:fix:all": "pnpm sync:snippets && pnpm -r lint:fix",