ci: packaging smoke test + tag-driven npm release

.github/workflows/release.yml

@@ -0,0 +1,52 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # npm provenance (OIDC)
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org
+
+      - name: Tag must match package.json
+        run: |
+          PKG=$(node -p "require('./package.json').version")
+          TAG="${GITHUB_REF_NAME#v}"
+          if [ "$PKG" != "$TAG" ]; then
+            echo "::error::tag v$TAG does not match package.json $PKG"
+            exit 1
+          fi
+
+      - run: npm test
+      - run: npm run check:skill
+
+      # Keeps re-runs and back-filled tags from failing on a version that is
+      # already on the registry, which is not an error condition.
+      - name: Is this version already published?
+        id: check
+        run: |
+          if npm view "astro-seo-toolkit@${GITHUB_REF_NAME#v}" version >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "astro-seo-toolkit@${GITHUB_REF_NAME#v} is already on npm — skipping publish."
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish to npm
+        if: steps.check.outputs.exists == 'false'
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      # Alternative to the NPM_TOKEN secret: configure a trusted publisher for
+      # this repo + workflow on npmjs.com, then drop the env block above.
+      # OIDC publishing needs no long-lived token and always carries provenance.

.github/workflows/test.yml

@@ -16,3 +16,29 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
       - run: npm test
+      - run: npm run check:skill
+
+  # Install the packed tarball and invoke the bins the way a user does.
+  # Catches packaging regressions (missing files, broken bin entrypoints,
+  # no-op CLIs) that unit tests against the source tree cannot see.
+  package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm pack
+      - run: |
+          mkdir -p /tmp/smoke && cd /tmp/smoke
+          npm init -y
+          npm install "$GITHUB_WORKSPACE"/astro-seo-toolkit-*.tgz
+          mkdir -p content
+          printf -- '---\ntitle: Smoke\ndescription: smoke\n---\n# Smoke\n' > content/a.md
+          npx astro-seo-toolkit --dir content --site https://example.com --out dist --llms-full
+          npx astro-seo-check --dir dist --site https://example.com
+          for f in llms.txt llms-full.txt sitemap.xml robots.txt; do
+            test -s "dist/$f" || { echo "missing or empty: dist/$f"; exit 1; }
+          done
+          npx astro-seo-sitemap --dir content --site https://example.com | grep -q '<urlset'
+          echo "package smoke test ok"