Create a release #2

	name: Create a release
	on: workflow_dispatch

	concurrency:
	group: release-${{ github.ref }}
	cancel-in-progress: false

	jobs:
	release:
	runs-on: ubuntu-latest
	permissions:
	contents: write # to push tags and create the GitHub release
	issues: write # to comment on released issues
	pull-requests: write # to comment on released pull requests
	id-token: write # to mint the OIDC token for npm provenance / trusted publishing
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0 # semantic-release needs full history and tags

	- name: Setup
	uses: ./.github/actions/setup
	with:
	github_token: ${{ secrets.GITHUB_TOKEN }}

	# Tokenless trusted publishing needs npm >= 11.5.1. The repo's .nvmrc
	# pins Node 22 (npm 10), and `npm install -g npm@latest` self-upgrade is
	# broken on that npm (MODULE_NOT_FOUND 'promise-retry'). So switch the
	# publish steps to Node 24, which already bundles npm 11.6+.
	- name: Use Node with npm 11+
	uses: actions/setup-node@v4
	with:
	node-version: "24"
	registry-url: "https://registry.npmjs.org"

	- name: Build packages
	run: yarn turbo run build --filter='./packages/*'

	- name: Release
	working-directory: packages/webgpu
	run: yarn release
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	# Trusted publishing authenticates via the OIDC id-token, so no npm
	# token is needed. These are set empty so semantic-release-yarn's
	# verifyConditions step does not trip on a missing token.
	YARN_NPM_AUTH_TOKEN: ''
	NPM_TOKEN: ''
	NPM_CONFIG_PROVENANCE: true

Provide feedback