ci: auto-publish to npm on push to main

Author: OCWatch Dev

.github/workflows/publish.yml

@@ -0,0 +1,51 @@
+name: Publish
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    # Skip automated version bump commits (pushed by GITHUB_TOKEN, which
+    # doesn't trigger workflows anyway — this is defense-in-depth)
+    if: "!contains(github.event.head_commit.message, '[release]')"
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: |
+          bun install
+          cd src/client && bun install
+
+      - name: Build client
+        run: cd src/client && bun run build
+
+      - name: Bump version
+        id: version
+        run: |
+          npm version patch --no-git-tag-version
+          echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
+
+      - name: Publish to npm
+        run: |
+          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
+          bun publish --access public
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Commit version bump
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add package.json
+          git commit -m "v${{ steps.version.outputs.version }} [release]"
+          git tag "v${{ steps.version.outputs.version }}"
+          git push
+          git push --tags