chore: npm publish & release-please setup

[amondnet]

Summary

• Add release-please configuration for monorepo (packages/cli only)
• Add .github/workflows/release.yml with two jobs: release-please + npm publish
• Update packages/cli/package.json with repository, files, publishConfig fields
• Publish flow: bun pack (workspace dep resolution) → npm publish --provenance (SLSA attestation)
• Uses npm trusted publisher (OIDC) via environment: npm + id-token: write

Closes #16

Setup Required

After merging, repo admin must:

1. Create npm environment in GitHub repo settings
2. Configure trusted publisher on npmjs.com for @pleaseai/ask (or add NPM_TOKEN secret as fallback)

Test Plan

• Verify release-please-config.json is valid JSON
• Verify .release-please-manifest.json version matches packages/cli/package.json
• Verify release.yml syntax with actionlint or GitHub Actions linter
• After merge to main: confirm release-please creates a Release PR
• After Release PR merge: confirm npm publish succeeds with provenance

---

Summary by cubic

Automates releases and npm publishing for @pleaseai/ask (packages/cli) using release-please and GitHub Actions. On Release PR merge, builds with bun, packs via bun pm pack into a tarball, then publishes that tarball to npm with provenance via trusted publisher (OIDC), addressing #16.

• Migration
  • Create the npm environment in GitHub repo settings.
  • Enable npm Trusted Publisher for @pleaseai/ask (or add NPM_TOKEN as a fallback).

^{Written for commit 34da69b. Summary will update on new commits.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cloudflare-workers-and-pages]

Deploying ask-registry with    Cloudflare Pages

Latest commit:	34da69b
Status:	⚡️  Build in progress...

View logs

[cubic-dev-ai]

2 issues found across 8 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/release.yml">

<violation number="1" location=".github/workflows/release.yml:10">
P2: Avoid granting `id-token: write` at workflow scope; it unnecessarily expands OIDC token permissions to non-publish jobs.</violation>

<violation number="2" location=".github/workflows/release.yml:40">
P2: Pin Bun to a specific version in the release workflow to keep publish builds reproducible and aligned with the repo toolchain.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant Dev as Maintainer
    participant GHA as GitHub Actions
    participant RP as Release Please
    participant npm as npm Registry (OIDC)

    Note over Dev, npm: Setup: Configure Trusted Publisher (OIDC) on npmjs.com

    Dev->>GHA: Push/Merge to 'main' branch
    GHA->>RP: NEW: Run release-please-action
    RP->>RP: Parse conventional commits
    RP->>GHA: NEW: Create/Update Release PR (version bump + changelog)

    Note over Dev, GHA: Execution: Merging the Release PR

    Dev->>GHA: Merge Release PR to 'main'
    GHA->>RP: NEW: Run release-please-action
    RP-->>GHA: Output: release_created=true, tag_name=vX.Y.Z

    alt NEW: Release Created
        GHA->>GHA: NEW: bun install (frozen-lockfile)
        GHA->>GHA: NEW: bun run build (packages/cli)
        GHA->>GHA: NEW: bun pack (resolves workspace dependencies)
        
        Note over GHA, npm: Auth via GitHub OIDC Token (id-token: write)
        
        GHA->>npm: NEW: npm publish --provenance (SLSA attestation)
        
        alt Success
            npm-->>GHA: 200 OK (Package Published)
        else Failure (e.g. Auth/Version Conflict)
            npm-->>GHA: 4xx/5xx Error
            Note right of GHA: Job Fails (Requires manual retry or fix)
        end
    else No release created
        Note right of GHA: Skip npm-publish job
    end

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

_{Requires human review: This PR sets up CI/CD workflows for automated releases and npm publishing, which is explicitly listed as a high-impact change requiring human review.}

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

_{Requires human review: Adds a new CI/CD workflow for automated releases and npm publishing, which is classified as a high-impact infrastructure change requiring human review.}