chore: add changesets release workflows

Two workflows:
- changesets-pr.yml: creates/updates a "version package" PR when
  changesets land on main
- release.yml: publishes to npm with OIDC provenance when the
  version PR is merged

Uses npm 11.6.4 for OIDC support. Requires npm-publish environment
and NPM_TOKEN secret on the repo.

Author: ericallam

.github/workflows/changesets-pr.yml

@@ -0,0 +1,47 @@
+name: Changesets PR
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".changeset/**"
+      - "src/**"
+      - "package.json"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changesets-pr:
+    if: github.repository == 'triggerdotdev/agentcrumbs'
+    name: Create Release PR
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Create Release PR
+        uses: changesets/action@v1
+        with:
+          title: "chore: version package"
+          commit: "chore: version package"
+          version: pnpm changeset version
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -1,23 +1,32 @@
 name: Release
 
 on:
-  push:
+  pull_request:
+    types:
+      - closed
     branches:
       - main
 
-concurrency: ${{ github.workflow }}-${{ github.ref }}
-
-permissions:
-  contents: write
-  pull-requests: write
-  id-token: write
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
 
 jobs:
   release:
-    name: Release
+    if: >
+      github.repository == 'triggerdotdev/agentcrumbs' &&
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.head.ref == 'changeset-release/main'
+    name: Publish to npm
     runs-on: ubuntu-latest
+    environment: npm-publish
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - uses: pnpm/action-setup@v4
         with:
@@ -29,20 +38,23 @@ jobs:
           cache: pnpm
           registry-url: https://registry.npmjs.org
 
+      # npm 11.5.1+ required for OIDC publishing
+      - run: npm install -g npm@11.6.4
+
       - run: pnpm install --frozen-lockfile
 
       - run: pnpm build
 
       - run: pnpm typecheck
 
-      - name: Create Release PR or Publish
-        uses: changesets/action@v1
-        with:
-          title: "chore: version packages"
-          commit: "chore: version packages"
-          version: pnpm changeset version
-          publish: pnpm changeset publish
+      - name: Publish to npm
+        run: pnpm changeset publish
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true
+
+      - name: Create git tags
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          git tag "v${VERSION}"
+          git push origin "v${VERSION}"