ci: add release workflow

.github/workflows/ci.yml

@@ -44,12 +44,6 @@ jobs:
         with:
           node-version: 20
 
-      # - name: Start LocalStack
-      #   uses: LocalStack/[email protected]
-      #   with:
-      #     image-tag: 'latest'
-      #     install-awslocal: 'true'
-
       - name: Build
         run: pnpm build
 
@@ -60,27 +54,4 @@ jobs:
         if: ${{ steps.install.conclusion == 'success' }}
         uses: davelosert/vitest-coverage-report-action@v2
         with:
-          vite-config-path: vitest.root.ts
-
-  release:
-    name: Release
-    needs: [lint, test]
-    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Only run on main push
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup and Install
-        id: install
-        uses: ./.github/actions/setup-and-install
-        with:
-          node-version: 20
-
-      - name: Publish
-        id: changesets
-        uses: changesets/action@v1
-        with:
-          publish: pnpm release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          vite-config-path: vitest.root.ts

.github/workflows/release.yml

@@ -0,0 +1,38 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
+permissions:
+  checks: write
+  contents: write
+  pull-requests: write
+  packages: read
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup and Install
+        id: install
+        uses: ./.github/actions/setup-and-install
+        with:
+          node-version: 20
+
+      - name: Publish
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          publish: pnpm release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}