ci: split CI and release workflows

- CI.yml: lint + build + test on push/PR (no publish)
- release.yml: triggered by GitHub release, builds all platforms, publishes to npm + crates.io
- Uses release tag to determine npm dist-tag (stable vs next)

Author: xusd320

.github/workflows/CI.yml .github/workflows/ci.yml.github/workflows/CI.yml renamed to .github/workflows/ci.yml

@@ -4,8 +4,7 @@ env:
   APP_NAME: "domparser-rs"
   MACOSX_DEPLOYMENT_TARGET: "10.13"
 permissions:
-  contents: write
-  id-token: write
+  contents: read
 "on":
   push:
     branches:
@@ -334,50 +333,4 @@ jobs:
             -v ${{ github.workspace }}:/build \
             -w /build \
             node:lts-alpine \
-            /bin/sh -c "set -e && yarn test"
-  publish:
-    name: Publish
-    runs-on: ubuntu-latest
-    needs:
-      - test-macOS-windows-binding
-      - test-linux-x64-gnu-binding
-      - test-linux-x64-musl-binding
-      - test-linux-aarch64-gnu-binding
-      - test-linux-aarch64-musl-binding
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: yarn
-      - name: Install dependencies
-        run: yarn install
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-      - name: Move artifacts
-        run: yarn artifacts
-      - name: List packages
-        run: ls -R ./npm
-        shell: bash
-      - name: Publish
-        run: |
-          npm config set provenance true
-          if git log -1 --pretty=%B | grep "^[0-9]\+\.[0-9]\+\.[0-9]\+$";
-          then
-            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-            npm publish --access public --provenance
-            cargo publish -p domparser --token $CARGO_REGISTRY_TOKEN
-          elif git log -1 --pretty=%B | grep "^[0-9]\+\.[0-9]\+\.[0-9]\+";
-          then
-            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-            npm publish --tag next --access public --provenance
-          else
-            echo "Not a release, skipping publish"
-          fi
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+            /bin/sh -c "set -e && yarn test"