ci: publish npm packages from GitHub Actions

[aryasaatvik]

Summary

Public integration packages publish from GitHub Actions via tegami ci and npm
OIDC trusted publishing. Merging the Version Packages PR is the human gate.
This public repo should get npm provenance attestations on the first CI publish.

Flow

changelog lands on main
  -> publish.yml runs tegami ci
  -> Version Packages PR (no publish yet)
human merges that PR (not GITHUB_TOKEN auto-merge)
  -> publish.yml runs tegami ci
  -> npm publish over OIDC + provenance + GitHub Releases

npm: {
  client: "bun",
  trustedPublish: { provider: "github", workflow: "publish.yml" },
}

Do not rename publish.yml. npm pins that filename on @samva/better-auth and
@samva/email-sdk.

PR changelog previews use a split workflow: tegami-pr.yml (read, artifact)
then tegami-pr-comment.yml (comment).

The leftover .tegami/publish-lock.yaml from the 0.1.1 version PR is removed.
git and npm already match 0.1.1, so the first publish.yml run should no-op.

Validation

• bun run tegami --help — ci, pr preview, pr comment, and npm pretrust are registered
• bun run tegami check-publish — exits 1 (nothing pending)
• YAML parse of the three new workflow files
• bun run format:check

Follow-up

After merge, set GitHub Actions trusted publisher
AryaLabsHQ/samva-integrations / publish.yml (no environment) on both npm
packages. First real version bump waits on a changelog. Laptop bun run release
stays emergency-only until that publish succeeds.

[greptile-apps]

Greptile Summary

The PR moves npm package releases to a GitHub Actions and OIDC trusted-publishing flow, with merging the generated Version Packages PR remaining the human gate.

• Adds the main-branch version-and-publish workflow.
• Adds split pull-request preview and privileged comment workflows.
• Configures Tegami for GitHub trusted publishing and non-forced version PR creation.
• Updates release documentation and removes the stale publish lock.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/publish.yml	Adds a serialized main-branch workflow that versions and publishes packages with GitHub OIDC permissions.
.github/workflows/tegami-pr.yml	Generates the Tegami release preview in the unprivileged pull-request workflow and uploads it as a single artifact.
.github/workflows/tegami-pr-comment.yml	Downloads the preview into an isolated temporary directory before the default-branch command posts it with pull-request write permission, resolving the previously reported workspace-overwrite path.
scripts/tegami.mts	Enables GitHub trusted publishing for publish.yml and allows Tegami to reuse an existing Version Packages PR.
docs/releases.md	Documents the automated versioning, OIDC publishing, verification, retry, and emergency local-release procedures.

Sequence Diagram

sequenceDiagram
  participant Contributor
  participant Main as main branch
  participant Publish as publish.yml
  participant Tegami
  participant VersionPR as Version Packages PR
  participant npm
  Contributor->>Main: Merge changelog
  Main->>Publish: Trigger push workflow
  Publish->>Tegami: tegami ci
  Tegami->>VersionPR: Open or update version PR
  Contributor->>VersionPR: Review and merge
  VersionPR->>Main: Version changes and publish lock
  Main->>Publish: Trigger push workflow
  Publish->>Tegami: tegami ci
  Tegami->>npm: Publish via OIDC with provenance

Loading

_{Reviews (2): Last reviewed commit: "ci: isolate Tegami preview artifact from..." | Re-trigger Greptile}

[aryasaatvik]

@greptile review