ci: update release.yml to be consistent with sidebase

Author: phoenix-ru

.github/workflows/release.yml

@@ -1,49 +1,77 @@
-name: Release
+name: Release on NPM
 
 on:
-  push:
-    branches:
-      - "main"
-      - "beta"
-      - "next"
-      - "3.x"
-      - "v4"
-  pull_request:
-  workflow_dispatch:
+  release:
+    types: [published] # runs when a GitHub Release is published
+
+permissions:
+  contents: read
+  id-token: write # required for npm provenance
 
 env:
   NODE_VER: 24.14
-  WORKING_DIR: packages/next-auth
+  CI: true
 
 defaults:
   run:
     working-directory: packages/next-auth
 
 jobs:
-  test:
-    name: Test
+  publish:
+    name: Publish package from release tag
+    # Run only when tag is in the format `vX.Y.Z` produced by `npm version`
+    if: startsWith(github.event.release.tag_name, 'v')
     runs-on: ubuntu-latest
+
     steps:
-      - name: Init
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - name: Check out the tag referenced by this release
+        uses: actions/checkout@v5
         with:
-          fetch-depth: 2
+          ref: ${{ github.event.release.tag_name }}
+          fetch-depth: 0
 
       - name: Install pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320
+        uses: pnpm/action-setup@v4
         with:
           run_install: false
-          cache_dependency_path: ${{ env.WORKING_DIR }}/pnpm-lock.yaml
 
-      - name: Setup Node
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
+      - name: Setup Node.js and pnpm
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VER }}
-          cache: pnpm
-          cache-dependency-path: ${{ env.WORKING_DIR }}/pnpm-lock.yaml
+          cache: 'pnpm'
+          # This is required for `setup-node` to generate the registry URL into .npmrc
+          # See https://github.com/actions/setup-node/blob/5e2628c959b9ade56971c0afcebbe5332d44b398/action.yml#L17-L18
+          registry-url: 'https://registry.npmjs.org/'
+
+      - name: Verify tag matches package.json version
+        run: |
+          TAG="${{ github.event.release.tag_name }}"
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          if [ "v$PKG_VERSION" != "$TAG" ]; then
+            echo "::error ::Tag ($TAG) does not match package.json version (v$PKG_VERSION)"
+            exit 1
+          fi
+
+      - name: Install deps
+        run: |
+          pnpm --version
+          pnpm install --frozen-lockfile
+
+      # Note: no build step because npm publish would run `prepublishOnly` script which builds the package
+
+      - name: Publish to npm with provenance
+        run: |
+          TAG="${{ github.event.release.tag_name }}"
+
+          # Stable release (vX.Y.Z)
+          if echo "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+            npm publish --provenance --access public
 
-      - name: Install dependencies
-        run: pnpm i --frozen-lockfile
+          # Pre-release (vX.Y.Z-*)
+          elif echo "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+-'; then
+            npm publish --provenance --access public --tag next
 
-      - name: Build
-        run: pnpm build
+          else
+            echo "Not a valid release tag ($TAG), skipping publish."
+          fi