ci(release): automate package publishing

Author: altaywtf

.github/workflows/publish-package.yml

@@ -1,16 +1,15 @@
 name: Publish Package
 
 on:
-  workflow_dispatch:
-    inputs:
-      dist_tag:
-        description: npm dist-tag
-        required: true
-        default: next
-        type: choice
-        options:
-          - next
-          - latest
+  push:
+    branches:
+      - main
+    paths:
+      - "DESIGN.md"
+      - "dist/**"
+      - "README.md"
+      - "system/README.md"
+      - "tokens/**"
 
 concurrency:
   group: putio-design-publish-package
@@ -28,8 +27,10 @@ jobs:
       name: release
       url: https://www.npmjs.com/package/@putdotio/design
     permissions:
-      contents: read
+      contents: write
       id-token: write
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -40,7 +41,6 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
         with:
           node-version-file: .node-version
-          registry-url: https://registry.npmjs.org
 
       - name: Set up pnpm
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
@@ -53,5 +53,5 @@ jobs:
       - name: Verify package and design system
         run: pnpm verify:full
 
-      - name: Publish to npm
-        run: npm publish --provenance --access public --tag "${{ inputs.dist_tag }}"
+      - name: Release package
+        run: pnpm exec semantic-release

.releaserc.json

@@ -0,0 +1,11 @@
+{
+  "branches": [
+    "main"
+  ],
+  "tagFormat": "v${version}",
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    "@semantic-release/npm"
+  ]
+}

docs/DISTRIBUTION.md

@@ -30,11 +30,12 @@ Do not publish platform-native outputs from this repo in v1. Web, iOS, Android,
 Roku, and TV repos should consume the generic token artifacts and own their
 platform adapters.
 
-Package publishing uses the manual `Publish Package` GitHub Actions workflow.
-The workflow runs `pnpm verify:full`, publishes with npm provenance, and expects
-npm Trusted Publishing to be configured for the `release` GitHub Environment.
-Use the `next` dist-tag for pre-release or adoption-test packages, and `latest`
-only for a release that should become the default npm install target.
+Package publishing uses semantic-release in the `Publish Package` GitHub Actions
+workflow. On `main`, design artifact changes run `pnpm verify:full` and then
+publish a package release when the commit history contains a releasable
+Conventional Commit. Commits such as `docs:` or `ci:` do not publish a package.
+
+Published packages use npm provenance and the default `latest` dist-tag.
 
 Before the first publish, an npm maintainer must trust this workflow for the
 package:

package.json

@@ -19,7 +19,8 @@
     "dtcg"
   ],
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "files": [
     "DESIGN.md",
@@ -54,8 +55,12 @@
   "devDependencies": {
     "@axe-core/playwright": "^4.11.3",
     "@playwright/test": "^1.60.0",
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/npm": "^13.1.5",
+    "@semantic-release/release-notes-generator": "^14.1.1",
     "@types/node": "^25.9.1",
     "html-validate": "^11.2.0",
+    "semantic-release": "^25.0.3",
     "sst": "^4.14.3",
     "style-dictionary": "^5.4.1",
     "typescript": "^6.0.2",