chore: add release PR workflow and npm provenance (#2434)

* chore: add release PR workflow and npm provenance

Adds a changesets-driven Release workflow that opens a "Version Packages"
PR on `next` and publishes when the PR is merged, with every tarball
signed via npm Trusted Publishing (OIDC, no NPM_TOKEN).

Also attaches SLSA provenance to the existing nightly and experimental
publishes via id-token: write + NPM_CONFIG_PROVENANCE=true, fixes the
stale baseBranch in .changeset/config.json (main -> next), and enables
@changesets/changelog-github so release PR bodies link back to source PRs.

* chore: allow release workflow to be triggered manually

* chore: drop redundant test gates from release workflow

Tests already pass on the PR via tests.yml before merge to next, so re-running them on the release path just adds latency.

* chore: align release workflow with Node 22 + actions v6

Author: joshuaellis

.changeset/config.json

@@ -1,11 +1,14 @@
 {
   "$schema": "https://unpkg.com/@changesets/config@1.6.0/schema.json",
-  "changelog": false,
+  "changelog": [
+    "@changesets/changelog-github",
+    { "repo": "pmndrs/react-spring" }
+  ],
   "commit": false,
   "fixed": [["@react-spring/*"]],
   "linked": [],
   "access": "public",
-  "baseBranch": "main",
+  "baseBranch": "next",
   "updateInternalDependencies": "patch",
   "ignore": ["@react-spring/demo", "@react-spring/docs"]
 }

.github/workflows/experimental.yml

@@ -16,6 +16,9 @@ jobs:
     name: 'Experimental Release'
     if: github.repository == 'pmndrs/react-spring'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Cancel Previous Runs
         uses: styfle/cancel-workflow-action@0.12.1

.github/workflows/nightly.yml

@@ -17,6 +17,9 @@ jobs:
     name: 'Nightly Release'
     if: github.repository == 'pmndrs/react-spring'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     outputs:
       NEXT_VERSION: ${{ steps.version.outputs.NEXT_VERSION }}
     steps:

.github/workflows/release.yml

@@ -0,0 +1,62 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - 'next'
+  workflow_dispatch:
+
+env:
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: false
+
+permissions: {}
+
+jobs:
+  release:
+    name: 'Release'
+    if: github.repository == 'pmndrs/react-spring'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'pnpm'
+          registry-url: 'https://registry.npmjs.org'
+
+      # npm Trusted Publishing requires npm >= 11.5.1; Node 22 LTS still ships npm 10.x
+      - name: Upgrade npm
+        run: npm install -g npm@latest
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build-ci
+
+      - name: Create release PR or publish
+        uses: changesets/action@v1
+        with:
+          version: pnpm vers
+          publish: pnpm changeset publish
+          title: 'chore: version packages'
+          commit: 'chore: version packages'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package.json

@@ -57,6 +57,7 @@
     }
   },
   "devDependencies": {
+    "@changesets/changelog-github": "^0.7.0",
     "@changesets/cli": "2.27.11",
     "@commitlint/cli": "19.6.1",
     "@commitlint/config-conventional": "19.6.0",

packages/animated/package.json

@@ -44,6 +44,9 @@
   "maintainers": [
     "Josh Ellis (https://github.com/joshuaellis)"
   ],
+  "publishConfig": {
+    "provenance": true
+  },
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf dist",

packages/core/package.json

@@ -47,6 +47,9 @@
   "maintainers": [
     "Josh Ellis (https://github.com/joshuaellis)"
   ],
+  "publishConfig": {
+    "provenance": true
+  },
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf dist",

packages/parallax/package.json

@@ -43,6 +43,9 @@
   "maintainers": [
     "Josh Ellis (https://github.com/joshuaellis)"
   ],
+  "publishConfig": {
+    "provenance": true
+  },
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf dist",

packages/rafz/package.json

@@ -41,6 +41,9 @@
   ],
   "license": "MIT",
   "author": "Josh Ellis",
+  "publishConfig": {
+    "provenance": true
+  },
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf dist",

packages/react-spring/package.json

@@ -43,6 +43,9 @@
   "maintainers": [
     "Josh Ellis (https://github.com/joshuaellis)"
   ],
+  "publishConfig": {
+    "provenance": true
+  },
   "dependencies": {
     "@react-spring/core": "~10.0.3",
     "@react-spring/konva": "~10.0.3",