fix: npm publish workflow

.github/workflows/npm-publish.yml

@@ -0,0 +1,76 @@
+name: npm-publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  # tag_name grouping - queues actual releases for the same tag
+  # run_id - fallback value required for group as tag_name might not always be present (manual triggers)
+  group: npm-publish-${{ github.event.release.tag_name || github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    name: Validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.release.tag_name || github.ref }}
+          persist-credentials: false
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22.x
+
+      - name: verify release version
+        if: github.event_name == 'release'
+        run: |
+          pkg_name=$(jq -r .name package.json)
+          pkg_version=$(jq -r .version package.json)
+          tag_version="${GITHUB_EVENT_RELEASE_TAG_NAME#v}"
+          if [ "$pkg_version" != "$tag_version" ]; then
+            echo "package.json version ($pkg_version) does not match release tag ($tag_version)"
+            exit 1
+          fi
+          if npm view "${pkg_name}@${pkg_version}" version >/dev/null 2>&1; then
+            echo "${pkg_name}@${pkg_version} is already published"
+            exit 1
+          fi
+        env:
+          GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
+
+      - name: validate publish package contents
+        run: |
+          npm pack --dry-run 2>&1 | tee pack.log
+          grep -q 'lib/' pack.log
+          ! grep -qE '[[:space:]]test/' pack.log
+          ! grep -qE '[[:space:]]tools/' pack.log
+
+  publish:
+    name: publish
+    needs: validate
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    environment: Publish
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22.x
+          registry-url: https://registry.npmjs.org
+
+      - name: publish to npm
+        run: npm publish --provenance

.github/workflows/release-please.yml

@@ -0,0 +1,16 @@
+on:
+  push:
+    branches:
+      - master
+name: release-please
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@v5
+        with:
+          release-type: node

.github/workflows/test.yml

@@ -12,13 +12,13 @@ jobs:
         node-version: [18, 20, 22]
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install
-        run: npm install
+        run: npm ci
       - name: Test / Lint / Codestyle
         run: make all
   test-optional:
@@ -29,12 +29,14 @@ jobs:
         node-version: [24]
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install
-        run: npm install
+        run: npm ci
+        continue-on-error: true
       - name: Test / Lint / Codestyle
         run: make all
+        continue-on-error: true

.gitignore

@@ -12,7 +12,6 @@ Thumbs.db
 
 /node_modules/
 npm-debug.log
-package-lock.json
 yarn.lock
 
 # build task results for ci

Makefile

@@ -26,8 +26,6 @@ ESLINT		:= $(NODE_BIN)/eslint
 ISTANBUL	:= $(NODE_BIN)/nyc
 MOCHA		:= $(NODE_BIN)/mocha
 _MOCHA		:= $(NODE_BIN)/_mocha
-UNLEASH		:= $(NODE_BIN)/unleash
-CONVENTIONAL_RECOMMENDED_BUMP := $(NODE_BIN)/conventional-recommended-bump
 
 
 #
@@ -72,17 +70,6 @@ githooks: ## Install githooks
 	@ln -s $(GIT_HOOK_SRC) $(GIT_HOOK_DEST)
 
 
-.PHONY: release-dry
-release-dry: $(NODE_MODULES) ## Dry run of `release` target
-	$(UNLEASH) -d --type=$(shell $(CONVENTIONAL_RECOMMENDED_BUMP) -p angular)
-
-
-.PHONY: release
-release: $(NODE_MODULES) ## Versions, tags, and updates changelog based on commit messages
-	$(UNLEASH) --type=$(shell $(CONVENTIONAL_RECOMMENDED_BUMP) -p angular) --no-publish
-	$(NPM) publish
-
-
 .PHONY: lint
 lint: $(NODE_MODULES) ## Run lint and style checks
 	@$(ESLINT) $(ALL_FILES)