ci: automate releases with release-please and npm trusted publishing

.github/workflows/pr-title.yml

@@ -0,0 +1,24 @@
+name: pr-title
+
+# PRs are squash-merged, so the PR title becomes the commit on main. This
+# keeps that title a valid conventional commit so release-please can derive
+# the next version and changelog from it.
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+      - reopened
+
+permissions:
+  pull-requests: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release-please.yml

@@ -0,0 +1,44 @@
+name: release-please
+
+on:
+  push:
+    branches:
+      - main
+
+# Restrict the default token; each job opts into what it needs.
+permissions: {}
+
+jobs:
+  # Maintains a "release PR" that bumps the version and updates the changelog
+  # from the conventional commits merged into main. Merging that PR tags the
+  # release and creates the GitHub release, which triggers the publish job.
+  release-please:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - uses: googleapis/release-please-action@v4
+        id: release
+
+  # Publishes to npm only once release-please has cut a release. Uses npm
+  # trusted publishing (OIDC) so no long-lived token is stored in the repo;
+  # the trusted publisher must be configured for pidtree on npmjs.com.
+  publish:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      # Trusted publishing requires npm >= 11.5.0.
+      - run: npm install -g npm@latest
+      - run: npm publish --provenance

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.6.0"
+}

release-please-config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "last-release-sha": "1a25bdd19beb179eebcad17f2cfe9e9268a4bca5",
+  "packages": {
+    ".": {
+      "release-type": "node",
+      "package-name": "pidtree",
+      "skip-changelog": true
+    }
+  }
+}