[nonchalanttee22-lgtm]

Summary
The SDK could only be installed from git because there was no release workflow, even though package.json already declares its published files (dist, README.md, LICENSE). This PR adds a release workflow triggered on v* tags that checks the tag against the package version, runs checks and the build, publishes to npm with provenance, and creates a GitHub release. It also documents the process in CONTRIBUTING.md.

Closes #3

Validation

Both runs are real GitHub Actions runs of this workflow, not a local replay. act was not usable from my environment (the Docker socket is not accessible), so I added a rehearsal entry point instead: a manual run executes every step except the upload and the release, which are gated on github.event_name == 'push'. A branch cannot publish.

• Matching tag, v0.1.0 — success: https://github.com/nonchalanttee22-lgtm/keygate-client/actions/runs/41603043328
  Steps, in order: install from the lockfile, Tag matches package.json, pnpm check, pnpm build, npm upgrade, npm publish --dry-run plus tarball assertions. Publish to npm shows as skipped because this was a manual run, and the release job is skipped for the same reason.
• Mismatched tag, v0.2.0 — failure, as required: https://github.com/nonchalanttee22-lgtm/keygate-client/actions/runs/41603251363

  tag=v0.2.0
  package.json version=0.1.0
  ##[error]tag v0.2.0 does not match package.json version (expected v0.1.0)
  ##[error]Process completed with exit code 1.
  

  Check, Build, the npm upgrade, the tarball check and Publish to npm are all skipped after the guard fails.

npm name

keygate-client is free: npm view keygate-client returns E404 Not Found - GET https://registry.npmjs.org/keygate-client. No scoped name is needed and package.json is unchanged.

---

What changed

.github/workflows/release.yml (new)

• Triggers on tags matching v*, plus workflow_dispatch with a tag input for rehearsal (upload and release are skipped on manual runs).
• publish job: contents: read and id-token: write; the separate release job gets contents: write, so the step that publishes to npm never holds write access.
• Checks out the repo, sets up Node 20, runs corepack enable, then pnpm install --frozen-lockfile.
• Fails the job if the tag does not equal v + the version in package.json, before check, build or any publish step.
• Runs pnpm check, then pnpm build, then npm publish --dry-run + npm pack --dry-run assertions that dist/index.js, dist/index.d.ts, LICENSE and README.md ship.
• Installs npm ^11.5.1 before publishing: Node 20 bundles npm 10, and npm's OIDC/trusted publishing needs 11.5.1 or later.
• Publishes with npm publish --provenance --access public.
• Creates a GitHub release with generated notes.
• No token is stored in the repo. Publishing uses the NPM_TOKEN secret (passed as NODE_AUTH_TOKEN), or npm trusted publishing when the maintainer configures it and leaves the secret unset.
• Provenance needs repository.url in package.json to match the repository running the workflow (case-sensitively). It does: git+https://github.com/TeethakingBuilds/keygate-client.git. Releases must therefore run upstream; a fork publishing the same name would be rejected with E422.

CONTRIBUTING.md

• New "Releasing" section: bump the version, optionally rehearse the workflow from the Actions tab, tag the merge commit, and what the workflow checks. It also covers the version-mismatch failure, the two authentication setups, the npm 11 requirement, the provenance/repository requirement, and why a published version cannot be reused.

---

How to verify

• The two run links above: one green through the tarball check, one failing at the version guard with everything after it skipped.
• Confirm the publish job's runner log reports Contents: read (visible near the top of the failing run's log).
• Confirm no token or secret value appears anywhere in the repo.
• Read the new CONTRIBUTING.md section and follow it as written.

---

Checklist

• release.yml triggers on v* tags
• Node 20, corepack enable, pnpm install --frozen-lockfile
• Job fails if the tag does not equal v + package.json version
• pnpm check and pnpm build run before publish
• npm publish --provenance --access public with id-token: write and contents: read
• GitHub release created with generated notes
• keygate-client name availability checked, scoped name proposed in the issue if taken
• CONTRIBUTING.md has a "Releasing" section
• No token stored in the repo
• Workflow validated with --dry-run or act, log linked in the PR
• Closes Publish to npm from a tagged release with provenance #3

[teethaking]

nice implementation but ...What’s missing

Validation log (an acceptance criterion). The issue requires a --dry-run on a test tag or an act run, with the log linked in the PR. The description lists how to verify, and its checklist includes this item, but I saw no log linked. The mismatch failure is correct in the code but unproven.
npm name check. The issue asks whether keygate-client is free on npm. The PR never reports a result, and CONTRIBUTING.md just asserts the package is unscoped. My search couldn’t settle it, so run npm view keygate-client yourself. If the name is taken, the first publish will fail.

Smaller points

Permissions: the issue says contents: read, but the release step needs contents: write, so the job has write access. That’s a reasonable call, but splitting publish and release into separate jobs would keep the publish step at read-only.
Trusted publishing: I believe npm’s OIDC publishing needs a newer npm than Node 20 bundles, so that path may fail without an npm upgrade step. The token path should work as written, so check this if you plan to go tokenless.
Provenance: it also needs the repository field in package.json to match this repo, which I couldn’t see.
Unfilled checklist item: the last item still reads Closes #[ISSUE_NUMBER]. The summary has the correct Closes #3.