chore: npm release workflow (OIDC + provenance)

.github/workflows/release.yml

@@ -0,0 +1,35 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+      - run: bun install --frozen-lockfile
+      - name: Verify the release tag matches package.json
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          PKG="$(node -p "require('./package.json').version")"
+          test "$TAG" = "$PKG" || { echo "release tag $TAG does not match package.json $PKG"; exit 1; }
+      - run: bun run typecheck
+      - run: bun test
+      - run: bun run build
+      - name: Publish to npm
+        run: |
+          npm install -g npm@latest
+          npm publish --provenance --access public

RELEASING.md

@@ -0,0 +1,12 @@
+# Releasing
+
+`@redbark/cli` publishes to npm from CI. Nobody publishes from a laptop.
+
+1. Bump `version` in `package.json` (semver) on `main` via a PR.
+2. Once merged, cut a GitHub Release with the tag `v<version>` (e.g. `v0.1.1`) — the tag must match `package.json`.
+3. `.github/workflows/release.yml` runs the checks, builds, and publishes with
+   [provenance](https://docs.npmjs.com/generating-provenance-statements).
+
+Auth is [npm Trusted Publishing](https://docs.npmjs.com/trusted-publishers) over
+OIDC — there is no `NPM_TOKEN` secret. The package's trusted publisher must point
+at this repo and `release.yml`.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redbark/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Redbark CLI — read your bank and brokerage data from the Redbark API in your terminal.",
   "type": "module",
   "bin": {