chore: merge dev into main

.github/workflows/release-please.yml

@@ -6,6 +6,9 @@ on:
   push:
     branches:
       - main
+      # dev reaches this workflow for the prerelease job only; release-please
+      # itself is gated to the release branch below.
+      - dev
 
 permissions:
   contents: write
@@ -19,6 +22,12 @@ jobs:
   release-please:
     name: Run release-please
     runs-on: ubuntu-latest
+    if: github.ref_name == 'main'
+    # Step outputs are invisible to other jobs, so the publish job below could
+    # never learn whether a release was cut without lifting them here.
+    outputs:
+      release-created: ${{ steps.release.outputs.release_created }}
+      tag-name: ${{ steps.release.outputs.tag_name }}
     steps:
       - name: Fetch Release App PEM from Bitwarden
         uses: bitwarden/sm-action@1238aae8fc64b212641190a9227c8a734ab1a793 # v3.0.1
@@ -79,3 +88,40 @@ jobs:
               -f "ref=refs/tags/$alias" -f "sha=$SHA" > /dev/null
             echo "::notice::Created $alias at $TAG ($SHA)."
           fi
+
+  publish-release:
+    name: Publish stable release
+    needs: release-please
+    if: needs.release-please.outputs.release-created == 'true'
+    permissions:
+      contents: read
+      # npm Trusted Publishing (OIDC) and the provenance attestation. No
+      # NPM_TOKEN exists in this repo; npm verifies this workflow against the
+      # trusted publisher configured on the package.
+      id-token: write
+    # `build-script` is left at its default: this repo's `build` writes the npm
+    # artifact itself. coverage-report needs `build:npm` there only because its
+    # `build` produces an Action bundle instead.
+    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@c7bd7b92c046bedcb164fbdc759da975642581c2 # unreleased — replace with the tag once workflows cuts v0.1.0
+    with:
+      tag-name: ${{ needs.release-please.outputs.tag-name }}
+
+  publish-prerelease:
+    name: Publish prerelease
+    # Skip the version-bump merges release-please pushes onto main — those are
+    # the stable release, and publishing a prerelease from them would shadow it.
+    if: >-
+      ${{
+        github.ref_name == 'dev'
+        || (
+          github.ref_name == 'main'
+          && !startsWith(github.event.head_commit.message, 'chore(main): release')
+          && !startsWith(github.event.head_commit.message, 'chore: release')
+        )
+      }}
+    permissions:
+      contents: read
+      id-token: write
+    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@c7bd7b92c046bedcb164fbdc759da975642581c2 # unreleased — replace with the tag once workflows cuts v0.1.0
+    with:
+      prerelease: true