fix(ci): publish to npm with provenance instead of bun publish (#12) #37

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	jobs:
	test:
	runs-on: ubuntu-latest
	strategy:
	matrix:
	bun-version: [latest]

	steps:
	- uses: actions/checkout@v4
	with:
	# Full history so SonarCloud can attribute new code / blame accurately.
	fetch-depth: 0
	# No later step needs authenticated git; keep the token out of .git/config.
	persist-credentials: false

	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: ${{ matrix.bun-version }}

	- name: Install dependencies
	run: bun install

	- name: Lint
	run: bun run lint

	- name: Type check
	run: bun run type-check

	- name: Run tests with coverage
	run: bun run test:coverage

	- name: Upload coverage reports to Codecov
	uses: codecov/codecov-action@v5
	with:
	token: ${{ secrets.CODECOV_TOKEN }}
	files: ./coverage/lcov.info
	continue-on-error: true

	- name: SonarCloud Scan
	uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
	continue-on-error: true
	env:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
	SONAR_HOST_URL: https://sonarcloud.io

	- name: Build
	run: bun run build

	- name: Check build output
	run: \|
	if [ ! -f dist/index.js ]; then
	echo "Build failed: dist/index.js not found"
	exit 1
	fi
	if [ ! -f dist/index.d.ts ]; then
	echo "Build failed: dist/index.d.ts not found"
	exit 1
	fi

Provide feedback