ci: GitHub release only; npm publish stays local

Author: false200

.github/workflows/release.yml

@@ -5,22 +5,23 @@ on:
     tags:
       - "v*.*.*"
 
+permissions:
+  contents: write
+
 jobs:
-  publish:
-    name: publish to npm
+  github-release:
+    name: create GitHub release
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
     steps:
       - uses: actions/checkout@v4
+
       - uses: pnpm/action-setup@v4
         with:
           version: 10
+
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
-          registry-url: "https://registry.npmjs.org"
           cache: pnpm
 
       - name: Install
@@ -32,7 +33,7 @@ jobs:
       - name: Build
         run: pnpm build
 
-      - name: Verify package matches tag
+      - name: Verify package version matches tag
         run: |
           PKG_VERSION=$(node -p "require('./package.json').version")
           TAG_VERSION="${GITHUB_REF_NAME#v}"
@@ -41,7 +42,7 @@ jobs:
             exit 1
           fi
 
-      - name: Publish to npm
-        run: pnpm publish --access public --no-git-checks --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Create GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true

CONTRIBUTING.md

@@ -42,9 +42,18 @@ Conventional commits are nice but not enforced. A short imperative summary is fi
 
 ## Releasing (maintainers)
 
-1. Bump `version` in `package.json`.
-2. Push a `vX.Y.Z` tag.
-3. The `release.yml` workflow runs the tests and publishes to npm.
+1. Bump `version` in `package.json` and commit to `main`.
+2. Push a `vX.Y.Z` tag — CI runs tests and creates the [GitHub Release](https://github.com/false200/Tooltrim/releases).
+3. Publish to npm locally (not from CI):
+
+```bash
+pnpm install
+pnpm test
+pnpm build
+pnpm publish --access public
+```
+
+You must be logged in to npm (`npm login`) and own the `tooltrim` package.
 
 ## Reporting issues