ci: add mise, changesets and the release workflows

.changeset/README.md

@@ -0,0 +1,3 @@
+# Changesets
+
+This folder is managed by [changesets](https://github.com/changesets/changesets). Drop one Markdown file per user-facing change here. See the docs for the full lifecycle.

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "changelog": ["@changesets/changelog-github", { "repo": "withvariablelab/brand" }],
+  "commit": true,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.changeset/first-release.md

@@ -0,0 +1,5 @@
+---
+"@variablelab/brand": minor
+---
+
+First release: the `vlab-brand` skill, the design tokens as CSS and JSON, the Logo, the Class stamps and the template for a Product's `brand/` folder.

.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches:
+      - main
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: 🛠️ Setup mise
+        uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
+        with:
+          install: true
+          cache: true
+
+      - name: 📦 Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: 🧬 Check generated files
+        run: pnpm check

.github/workflows/release.yml

@@ -0,0 +1,65 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      id-token: write # npm trusted publishing (OIDC)
+      contents: read
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: 🛠️ Setup mise
+        uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
+        with:
+          install: true
+          cache: true
+
+      - name: 📦 Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: 🔑 Mint vland-bot token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.VLAND_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.VLAND_BOT_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: 🧑‍💻 Configure git user
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+        run: |
+          user_id="$(gh api "/users/${APP_SLUG}[bot]" --jq .id)"
+          git config user.name "${APP_SLUG}[bot]"
+          git config user.email "${user_id}+${APP_SLUG}[bot]@users.noreply.github.com"
+
+      - name: 🚀 Release or version PR
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        with:
+          commit: "chore: update versions"
+          title: "chore: update versions"
+          publish: pnpm changeset publish
+          setupGitUser: false
+          github-token: ${{ steps.app-token.outputs.token }}
+          commitMode: github-api
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/workflow-audit.yml

@@ -0,0 +1,33 @@
+name: Workflow audit
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches:
+      - main
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  audit-workflows:
+    name: Audit workflows
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      # Repo root, not .github/: keeps annotation paths repo-relative.
+      - name: 🔒 Scan workflows
+        env:
+          # Enables zizmor's online audits.
+          GH_TOKEN: ${{ github.token }}
+        run: pipx run --spec zizmor==1.30.1 zizmor --format=github .

.github/zizmor.yml

@@ -0,0 +1,7 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # First-party withvariablelab/gh-actions is tracked at @main on purpose.
+        "withvariablelab/*": ref-pin
+        "*": hash-pin

AGENTS.md

@@ -28,3 +28,14 @@ Edit the source, then run `pnpm build`. `pnpm check` exits 1 when a generated fi
 | `assets/logo.svg` | `.github/readme/logo.svg`, the Logo on `ground` for the README |
 
 Inside Markdown, a generated block sits between `<!-- build:<name> -->` and `<!-- /build:<name> -->`. Write around the markers, never inside them. Whole generated files are marked `linguist-generated` in `.gitattributes`; a new one gets a line there too.
+
+## Tools
+
+mise installs node and pnpm, locally and in CI: run `mise install`, then `pnpm install`. `mise.toml` names the versions and `mise.lock` pins them with checksums; after changing a version in `mise.toml`, run `mise lock` and commit both.
+
+## Releasing
+
+- Changes to `skills/`, `tokens/`, `assets/`, `templates/`, `BRAND-USE.md` or the `exports` in `package.json` carry a changeset: run `pnpm changeset`. Changes to the README, LICENSE, this file or CI don't.
+- Major: a token, an export path or an asset path is removed or renamed. Minor: one is added, or a chapter. Patch: a value or a text changes.
+- Merging a change with a changeset to `main` opens or updates the "chore: update versions" pull request. Merging that pull request publishes to npm through trusted publishing.
+- Agents install the skill from `main` on GitHub, not from npm, so a change to `skills/` reaches them when it merges, before any release.

mise.toml

@@ -0,0 +1,9 @@
+[env]
+_.path = ["{{config_root}}/node_modules/.bin"]
+
+[tools]
+node = "24"
+pnpm = "10.30.3"
+
+[settings]
+lockfile = true

package.json

@@ -1,7 +1,6 @@
 {
   "name": "@variablelab/brand",
   "version": "0.0.0",
-  "private": true,
   "description": "Variable Lab's brand guideline, design tokens and shared assets",
   "license": "MIT",
   "author": "rcrd <ricardo@variable.land>",
@@ -28,6 +27,10 @@
     "build": "node scripts/build.ts",
     "check": "node scripts/build.ts --check"
   },
+  "devDependencies": {
+    "@changesets/changelog-github": "^0.7.0",
+    "@changesets/cli": "^2.31.0"
+  },
   "peerDependencies": {
     "@fontsource/ibm-plex-mono": "^5.3.0",
     "@fontsource/ibm-plex-sans": "^5.3.0"