Publish to npm via trusted publishing

.github/workflows/publish.yml

@@ -0,0 +1,59 @@
+name: Local Binding Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      version_type:
+        description: Version Type
+        required: true
+        default: patch
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+          - prerelease
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    if: github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    env:
+      VERSION_TYPE: ${{ inputs.version_type }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      # No registry-url: setup-node would write an .npmrc token line that shadows OIDC.
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24
+
+      - run: npm install -g npm@11.21.0
+
+      - name: Upgrade version
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          npm version "$VERSION_TYPE" --preid tp
+
+      - name: Publish
+        run: npm publish --access public --tag "$([ "$VERSION_TYPE" = prerelease ] && echo next || echo latest)"
+
+      - name: Push tag
+        if: inputs.version_type == 'prerelease'
+        run: git push origin "$(git describe --exact-match)"
+
+      - name: Push tag and version bump branch
+        if: inputs.version_type != 'prerelease'
+        run: |
+          branch="release-$(date +%s)"
+          git push --follow-tags origin "HEAD:refs/heads/$branch"
+          echo "Open the version bump PR: $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/compare/master...$branch?expand=1" | tee -a "$GITHUB_STEP_SUMMARY"