chore: add release ci

.github/workflows/publish.yml

@@ -1,24 +1,31 @@
-name: Publish Package
+name: Publish and Release
 
 on:
   push:
     tags:
       - '*.*.*'
 
-# OIDC Trusted Publishing 需要以下权限
-# - id-token: write - 允许 GitHub Actions 生成 OIDC token
-# - contents: read - 允许读取仓库内容
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+# npm Trusted Publishing 需要 id-token: write；创建 GitHub Release 需要
+# contents: write。
 permissions:
+  contents: write
   id-token: write
-  contents: read
 
 jobs:
   publish:
+    name: Publish npm package and create GitHub Release
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
-      - name: Checkout
+      - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
@@ -30,17 +37,33 @@ jobs:
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
+          cache: pnpm
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
-      - name: Run build
+      - name: Build
         run: pnpm build
 
-      - name: Run tests
+      - name: Test
         run: pnpm test
 
-      # 使用 OIDC Trusted Publishing 发布，无需 token
-      # 在 npmjs.com 上配置 Trusted Publisher 后，npm 会自动使用 OIDC 认证
+      - name: Create package tarball
+        id: pack
+        shell: bash
+        run: |
+          package_file="$(npm pack --json | node -e "let input=''; process.stdin.on('data', chunk => input += chunk); process.stdin.on('end', () => console.log(JSON.parse(input)[0].filename));")"
+          echo "file=$package_file" >> "$GITHUB_OUTPUT"
+
+      # 在 npmjs.com 为该仓库和 workflow 配置 Trusted Publisher 后，
+      # npm 会通过 GitHub OIDC 完成认证，无需 NPM_TOKEN。
       - name: Publish to npm
-        run: npm publish --access public
+        run: npm publish "${{ steps.pack.outputs.file }}" --access public --provenance
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          name: ${{ github.ref_name }}
+          files: ${{ steps.pack.outputs.file }}
+          generate_release_notes: true
+          fail_on_unmatched_files: true