ci: publish releases from CI, with a changelog

[sidgaikwad]

Fixes #35.

Publishing was a manual npm run build && npm publish from a maintainer's machine. prepublishOnly did run the checks, which is good — everything around the publish was missing:

• no git tags (git tag returns nothing — no v1.0.0/v1.0.1/v1.0.2)
• no GitHub Releases, which follows from that
• no CHANGELOG.md — the only record across three published versions is the pair of chore(release): commits
• no npm provenance

.github/workflows/release.yml

Triggered on a v* tag (plus workflow_dispatch). Re-runs lint / typecheck / test / build, publishes with --provenance, and creates the GitHub Release with generated notes.

Three details worth calling out:

• Tag/version guard. Before publishing, it checks $GITHUB_REF_NAME matches package.json. Publishing 1.0.2's contents under a v1.0.3 tag is unfixable on npm, so it's worth the five lines. Verified both branches locally:

  v1.0.2 -> accepted
  v9.9.9 -> REJECTED (pkg 1.0.2)
  

• Least privilege. Top-level permissions: contents: read; the job adds contents: write (the Release) and id-token: write (provenance requires OIDC).
• Checks run in the job as well as via prepublishOnly so the job fails before anything is published rather than midway through.

CHANGELOG.md

Backfilled for 1.0.0–1.0.2 by reading the git history between the release commits, with issue/PR links where I could identify them. Please sanity-check the 1.0.0 entry — there's no history boundary marking it, so it's a placeholder.

Also added a Releasing section to CONTRIBUTING with the tag-and-push flow.

What I could not verify

I have not run this workflow. I validated the YAML parses and exercised the tag-guard shell logic locally, but the publish path can only be proven by a real release. It also needs an NPM_TOKEN repository secret that doesn't exist yet — worth adding before the first tag, and worth a granular token scoped to this package.

Suggested first use: cut v1.0.3 from Unreleased, or backfill tags at the historical release commits (abed34d = 1.0.1, 459e0ad = 1.0.2) first if you want the Releases page to read completely.

[vercel]

@sidgaikwad is attempting to deploy a commit to the Unlayer Team on Vercel.

A member of the Team first needs to authorize it.