From b0e48e404d80c4953b0888e3336bd3b21f174b7c Mon Sep 17 00:00:00 2001
From: Ayo <ayo@ayco.io>
Date: Sun, 5 Jul 2026 17:16:02 +0200
Subject: [PATCH] ci: publishing

---
 .github/workflows/release.yml | 76 +++++++++++++++++++++++++++++++++--
 package.json                  |  3 ++
 2 files changed, 75 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cbe0d28..42dd8e8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,16 +1,16 @@
 name: Release
 
-permissions:
-  contents: write
-
 on:
   push:
     tags:
       - 'v*'
 
 jobs:
-  release:
+  changelog:
+    name: Changelog
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v6
         with:
@@ -24,3 +24,71 @@ jobs:
       - run: npx changelogithub
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+
+  publish-npm:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # Mints the short-lived OIDC credential used for trusted publishing.
+      # No npm token is stored anywhere — this is the credential.
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 11
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          registry-url: 'https://registry.npmjs.org'
+          cache: pnpm
+
+      # Trusted publishing (OIDC) requires npm >= 11.5.1.
+      - name: Ensure npm supports trusted publishing
+        run: npm install -g npm@latest
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build
+
+      # No NODE_AUTH_TOKEN: npm authenticates via OIDC using the trusted
+      # publisher configured on npmjs.com. Provenance is generated
+      # automatically, so --provenance is not needed.
+      - name: Publish
+        run: npm publish --access public
+
+  publish-gh-packages:
+    name: Publish to GitHub Packages
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 11
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@ayo-run'
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build
+
+      # GitHub Packages requires a scoped name matching the repository owner.
+      # The scoped name applies only to this registry; npm keeps the
+      # unscoped "web-component-base".
+      - name: Scope package name for GitHub Packages
+        run: npm pkg set name="@ayo-run/web-component-base"
+
+      - name: Publish
+        run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
diff --git a/package.json b/package.json
index a4d0721..f962bee 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,9 @@
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
   "scripts": {
     "preinstall": "npx only-allow pnpm",
     "start": "pnpm -F demo dev",