code-foundry 0.1.4

package/.github/scripts/turbo-cache-probe.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# A Turbo remote-cache hit can be resolved from package manifests alone. This
+# probe lets CI skip the full dependency install when every executable task is
+# already cached. It is deliberately conservative: only Bun projects with a
+# pinned Turbo version are eligible, and synthetic dependency-only tasks are
+# excluded from the hit decision.
+
+task="${1:?task name required}"
+
+set_output() {
+  printf '%s=%s\n' "$1" "$2" >> "${GITHUB_OUTPUT:-/dev/null}"
+}
+
+set_output hit false
+
+[ -n "${TURBO_TOKEN:-}" ] || exit 0
+[ -n "${TURBO_TEAM:-}" ] || exit 0
+[ -f package.json ] || exit 0
+[ -f bun.lock ] || [ -f bun.lockb ] || exit 0
+
+turbo_version="$(node <<'NODE'
+const fs = require('node:fs');
+const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+const groups = [
+  packageJson.devDependencies,
+  packageJson.dependencies,
+  packageJson.optionalDependencies,
+  packageJson.pnpm?.overrides,
+];
+for (const group of groups) {
+  const value = group?.turbo;
+  const match = typeof value === 'string' && value.match(/(\d+\.\d+\.\d+)/);
+  if (match) {
+    console.log(match[1]);
+    break;
+  }
+}
+NODE
+)"
+[ -n "$turbo_version" ] || exit 0
+
+turbo_home="${RUNNER_TEMP:-/tmp}/repo-foundry-turbo"
+probe_file="$(mktemp)"
+install_file="$(mktemp)"
+result_file="$(mktemp)"
+cleanup() { rm -f "$probe_file" "$install_file" "$result_file"; }
+trap cleanup EXIT
+
+if ! npm install --prefix "$turbo_home" --no-save --ignore-scripts --no-audit --no-fund \
+  "turbo@${turbo_version}" >"$install_file" 2>&1; then
+  echo "Turbo Probe: CLI unavailable; using full install"
+  exit 0
+fi
+
+turbo_bin="$turbo_home/node_modules/.bin/turbo"
+if [ ! -x "$turbo_bin" ]; then
+  echo "Turbo Probe: CLI unavailable; using full install"
+  exit 0
+fi
+
+if ! "$turbo_bin" run "$task" \
+  --dry=json --cache=remote:r --output-logs=none >"$probe_file" 2>&1; then
+  echo "Turbo Probe: CLI unavailable; using full install"
+  exit 0
+fi
+
+node - "$probe_file" >"$result_file" <<'NODE'
+const fs = require('node:fs');
+const file = process.argv[2];
+const text = fs.readFileSync(file, 'utf8');
+const start = text.indexOf('{');
+if (start < 0) {
+  console.log('invalid-json');
+  process.exit(0);
+}
+let report;
+try {
+  report = JSON.parse(text.slice(start));
+} catch {
+  console.log('invalid-json');
+  process.exit(0);
+}
+const runnable = (report.tasks || []).filter((entry) =>
+  entry.command !== '<NONEXISTENT>' && entry.resolvedTaskDefinition?.cache !== false,
+);
+const hits = runnable.filter((entry) => entry.cache?.status === 'HIT').length;
+const hit = runnable.length > 0 && hits === runnable.length;
+console.log(`tasks=${report.tasks?.length || 0} runnable=${runnable.length} hits=${hits} hit=${hit}`);
+NODE
+probe_result="$(cat "$result_file")"
+echo "Turbo Probe: $probe_result"
+if ! grep -q 'hit=true' <<<"$probe_result"; then
+  echo "Turbo Probe: remote cache incomplete; using full install"
+  exit 0
+fi
+
+turbo_bin_dir="${turbo_bin%/*}"
+echo "$turbo_bin_dir" >> "${GITHUB_PATH:-/dev/null}"
+printf 'REPO_FOUNDRY_TURBO_REMOTE_ONLY=true\n' >> "${GITHUB_ENV:-/dev/null}"
+set_output hit true

package/.github/template.yml

@@ -0,0 +1,7 @@
+version: 1
+template: code-foundry@latest
+languages: typescript
+features: all
+package_manager: bun
+release_type: node
+npm_publish: true

package/.github/template.yml.example

@@ -0,0 +1,8 @@
+# Repository-specific settings for the shared initializer and sync scripts.
+version: 1
+template: code-foundry@latest
+languages: auto
+features: all
+package_manager: auto
+release_type: auto
+npm_publish: false

package/.github/workflows/ci.yml

@@ -0,0 +1,166 @@
+name: CI
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [staging]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  format:
+    name: Format
+    runs-on: ${{ vars.REPO_FOUNDRY_FAST_RUNNER || 'ubuntu-latest' }}
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh should_run format >> "$GITHUB_OUTPUT"
+      - name: Format Probe
+        id: format-probe
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/format-fast-path.sh
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: ${{ steps.format-probe.outputs.hit != 'true' }}
+          install-python: false
+          install-rust: false
+          cache-build: false
+          # Warm the format cache on branch pushes without adding archive
+          # time to pull-request checks.
+          cache-save: ${{ github.event_name == 'push' }}
+          cache-format: true
+          task: format
+      - name: Format
+        if: steps.applicability.outputs.applicable == 'true'
+        id: format-fast
+        continue-on-error: ${{ steps.format-probe.outputs.hit == 'true' }}
+        run: bash .github/scripts/ci.sh format
+      - name: Setup Fallback
+        if: >-
+          steps.applicability.outputs.applicable == 'true' &&
+          steps.format-probe.outputs.hit == 'true' &&
+          steps.format-fast.outcome == 'failure'
+        uses: ./.github/actions/setup
+        with:
+          install: true
+          install-python: false
+          install-rust: false
+          cache-build: false
+          cache-save: false
+          cache-format: true
+          task: format
+      - name: Format Fallback
+        if: >-
+          steps.applicability.outputs.applicable == 'true' &&
+          steps.format-probe.outputs.hit == 'true' &&
+          steps.format-fast.outcome == 'failure'
+        run: bash .github/scripts/ci.sh format
+
+  lint:
+    name: Lint
+    runs-on: ${{ vars.REPO_FOUNDRY_FAST_RUNNER || 'ubuntu-latest' }}
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh should_run lint >> "$GITHUB_OUTPUT"
+      - name: Turbo Probe
+        id: turbo
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/turbo-cache-probe.sh lint
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: ${{ steps.turbo.outputs.hit != 'true' }}
+          install-python: false
+          cache-build: false
+          # Warm the lint cache on branch pushes without adding archive time
+          # to pull-request checks.
+          cache-save: ${{ github.event_name == 'push' }}
+          cache-lint: true
+          task: lint
+      - name: Lint
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/ci.sh lint
+
+  type-check:
+    name: Type-Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh should_run type_check >> "$GITHUB_OUTPUT"
+      - name: Turbo Probe
+        id: turbo
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/turbo-cache-probe.sh type-check
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: ${{ steps.turbo.outputs.hit != 'true' }}
+          install-python: false
+          cache-build: ${{ steps.applicability.outputs.rust == 'true' || vars.REPO_FOUNDRY_CACHE_BUILD == 'true' }}
+          cache-save: ${{ github.event_name == 'push' }}
+          task: type_check
+      - name: Type-Check
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/ci.sh type_check
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh should_run build >> "$GITHUB_OUTPUT"
+      - name: Turbo Probe
+        id: turbo
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/turbo-cache-probe.sh build
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: ${{ steps.turbo.outputs.hit != 'true' }}
+          install-python: false
+          cache-build: ${{ steps.applicability.outputs.rust == 'true' || vars.REPO_FOUNDRY_CACHE_BUILD == 'true' }}
+          cache-save: ${{ github.event_name == 'push' }}
+          task: build
+      - name: Build
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/ci.sh build

package/.github/workflows/codeql.yml

@@ -0,0 +1,160 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [staging]
+  schedule:
+    - cron: '31 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  packages: read
+  security-events: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  detect:
+    name: Detect
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+    outputs:
+      languages: ${{ steps.languages.outputs.languages }}
+      code_security: ${{ steps.security.outputs.status }}
+      actions_available: ${{ steps.languages.outputs.actions_available }}
+      actions_changed: ${{ steps.languages.outputs.actions_changed }}
+      actions_build_mode: ${{ steps.languages.outputs.actions_build_mode }}
+      javascript_available: ${{ steps.languages.outputs.javascript_available }}
+      javascript_changed: ${{ steps.languages.outputs.javascript_changed }}
+      javascript_build_mode: ${{ steps.languages.outputs.javascript_build_mode }}
+      python_available: ${{ steps.languages.outputs.python_available }}
+      python_changed: ${{ steps.languages.outputs.python_changed }}
+      python_build_mode: ${{ steps.languages.outputs.python_build_mode }}
+      rust_available: ${{ steps.languages.outputs.rust_available }}
+      rust_changed: ${{ steps.languages.outputs.rust_changed }}
+      rust_build_mode: ${{ steps.languages.outputs.rust_build_mode }}
+    steps:
+      - name: Detect Code Security
+        id: security
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          status="disabled"
+          if [ "${{ github.event.repository.private }}" != "true" ]; then
+            status="enabled"
+          else
+            status="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.security_and_analysis.code_security.status // "disabled"' 2>/dev/null || printf 'disabled')"
+          fi
+          printf 'status=%s\n' "$status" >> "$GITHUB_OUTPUT"
+      - name: Checkout
+        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+          # Detection only reads Git trees, paths, and small profile files;
+          # defer source blob transfer until the analyzer jobs.
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            package.json
+            bun.lock
+            bun.lockb
+            pnpm-lock.yaml
+            yarn.lock
+            package-lock.json
+      - id: languages
+        name: Detect languages
+        env:
+          CODEQL_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+          REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
+          REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
+        run: |
+          if [ "$REPO_FOUNDRY_PRIVATE" = "true" ] && [ "$REPO_FOUNDRY_CODE_SECURITY" != "enabled" ]; then
+            echo 'languages=[]' >> "$GITHUB_OUTPUT"
+          else
+            bash .github/scripts/codeql-languages.sh
+          fi
+
+  analyze-actions:
+    name: Analyze (Actions)
+    needs: detect
+    if: >-
+      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.actions_available == 'true' &&
+      needs.detect.outputs.actions_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Analyze
+        uses: ./.github/actions/codeql
+        with:
+          language: actions
+          build-mode: ${{ needs.detect.outputs.actions_build_mode }}
+          category: /language:actions
+
+  analyze-typescript:
+    name: Analyze (TypeScript)
+    needs: detect
+    if: >-
+      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.javascript_available == 'true' &&
+      needs.detect.outputs.javascript_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Analyze
+        uses: ./.github/actions/codeql
+        with:
+          language: javascript-typescript
+          build-mode: ${{ needs.detect.outputs.javascript_build_mode }}
+          category: /language:javascript-typescript
+
+  analyze-python:
+    name: Analyze (Python)
+    needs: detect
+    if: >-
+      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.python_available == 'true' &&
+      needs.detect.outputs.python_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Analyze
+        uses: ./.github/actions/codeql
+        with:
+          language: python
+          build-mode: ${{ needs.detect.outputs.python_build_mode }}
+          category: /language:python
+
+  analyze-rust:
+    name: Analyze (Rust)
+    needs: detect
+    if: >-
+      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.rust_available == 'true' &&
+      needs.detect.outputs.rust_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Analyze
+        uses: ./.github/actions/codeql
+        with:
+          language: rust
+          build-mode: ${{ needs.detect.outputs.rust_build_mode }}
+          category: /language:rust

package/.github/workflows/draft-pr.yml

@@ -0,0 +1,59 @@
+name: Draft PR
+
+on:
+  push:
+    branches:
+      - 'feat/*'
+      - 'fix/*'
+      - 'chore/*'
+      - 'refactor/*'
+      - 'docs/*'
+      - 'style/*'
+      - 'test/*'
+
+permissions:
+  contents: read
+  pull-requests: write
+
+env:
+  GH_TOKEN: ${{ github.token }}
+
+jobs:
+  create-draft-pr:
+    name: Create
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - name: Check
+        id: check-pr
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          EXISTING=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | jq 'length')
+          echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
+
+      - name: Create
+        if: steps.check-pr.outputs.existing == '0'
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          gh pr create \
+            --base staging \
+            --head "$BRANCH" \
+            --draft \
+            --title "[WIP] $BRANCH" \
+            --body "Draft PR created automatically by CI.
+
+            This PR is a draft and should not be merged until CI passes and a reviewer (or the Daily Review agent) marks it ready.
+
+            **CI Status:** Pending — this workflow triggered on push to \`$BRANCH\`."
+
+      - name: Mark ready
+        if: steps.check-pr.outputs.existing == '0'
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          PR_NUMBER=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number 2>/dev/null | jq '.[0].number')
+          if [ -n "$PR_NUMBER" ]; then
+            gh pr ready "$PR_NUMBER"
+          fi

package/.github/workflows/release-pr.yml

@@ -0,0 +1,66 @@
+name: Release PR
+
+on:
+  push:
+    branches: [staging]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+env:
+  GH_TOKEN: ${{ github.token }}
+
+jobs:
+  create-release-pr:
+    name: Create
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - name: Check
+        id: check-pr
+        run: |
+          EXISTING=$(gh pr list --limit 1 --base main --head staging --state open --json number 2>/dev/null | jq 'length')
+          echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
+
+      - name: Create
+        if: steps.check-pr.outputs.existing == '0'
+        run: |
+          DATE=$(date +%Y-%m-%d)
+          BODY_FILE="$RUNNER_TEMP/release-pr.md"
+          COMPARE_URL="repos/${GITHUB_REPOSITORY}/compare/main...staging"
+          COMPARE_FILE="$RUNNER_TEMP/release-compare.json"
+          gh api "$COMPARE_URL?per_page=100" > "$COMPARE_FILE"
+          TOTAL_COMMITS=$(jq -r '.total_commits // 0' "$COMPARE_FILE")
+          if [ "$TOTAL_COMMITS" -gt 100 ]; then
+            LAST_PAGE=$(( (TOTAL_COMMITS + 99) / 100 ))
+            gh api "$COMPARE_URL?per_page=100&page=$LAST_PAGE" > "$COMPARE_FILE"
+          fi
+          COMMITS=$(jq -r '.commits[] | "- \(.commit.message | split("\\n")[0]) (\(.sha[0:7]))"' "$COMPARE_FILE")
+          if [ -z "$COMMITS" ]; then
+            COMMITS='- No commits found since main.'
+          fi
+
+          cat > "$BODY_FILE" <<EOF
+          ## Release summary
+
+          Automated release PR from \`staging\` into \`main\` created on $DATE.
+
+          ### Changes since main
+
+          $COMMITS
+
+          ### Validation
+
+          - CI and security checks must pass before merge.
+          - Review migrations, configuration changes, and rollback notes.
+          EOF
+
+          gh pr create \
+            --base main \
+            --head staging \
+            --title "Release: staging -> main ($DATE)" \
+            --body-file "$BODY_FILE"

package/.github/workflows/release.yml

@@ -0,0 +1,103 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  release:
+    name: Release / Version
+    runs-on: ubuntu-slim
+    timeout-minutes: 20
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: false
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created || 'false' }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+      npm_publish: ${{ steps.profile.outputs.npm_publish }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          # Release Please reads release metadata and manifests; defer source
+          # blob transfer until a package file is actually needed.
+          filter: blob:none
+      - name: Detect release profile
+        id: profile
+        shell: bash
+        run: |
+          release_type="$(awk -F': ' '/^release_type:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
+          npm_publish="$(awk -F': ' '/^npm_publish:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
+          [ -n "$release_type" ] || release_type=auto
+          [ -n "$npm_publish" ] || npm_publish=false
+
+          if [ "$release_type" = auto ]; then
+            if [ -f package.json ]; then release_type=node
+            elif [ -f pyproject.toml ]; then release_type=python
+            elif [ -f Cargo.toml ]; then release_type=rust
+            elif [ -f version.txt ]; then release_type=simple
+            else release_type=none
+            fi
+          fi
+
+          case "$release_type" in
+            node|python|rust|simple) ;;
+            none) npm_publish=false ;;
+            *) echo "Unsupported release_type: $release_type" >&2; exit 2 ;;
+          esac
+          if [ ! -f package.json ]; then npm_publish=false; fi
+          printf 'release_type=%s\n' "$release_type" >> "$GITHUB_OUTPUT"
+          printf 'npm_publish=%s\n' "$npm_publish" >> "$GITHUB_OUTPUT"
+      - name: Release Please
+        id: release
+        if: steps.profile.outputs.release_type != 'none'
+        uses: googleapis/release-please-action@v5
+        with:
+          # Use a PAT or GitHub App token when GITHUB_TOKEN cannot create PRs.
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          config-file: release-please-config.json
+          release-type: ${{ steps.profile.outputs.release_type }}
+          bump-minor-pre-major: true
+
+  npm:
+    name: Release / Publish npm
+    needs: release
+    if: needs.release.outputs.release_created == 'true' && needs.release.outputs.npm_publish == 'true'
+    runs-on: ubuntu-slim
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+    steps:
+      - name: Checkout release
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.release.outputs.tag_name }}
+      - name: Setup Node (trusted)
+        if: env.NPM_TOKEN == ''
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Setup Node (token)
+        if: env.NPM_TOKEN != ''
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+      - name: Publish npm with token
+        if: env.NPM_TOKEN != ''
+        env:
+          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
+        run: npm publish --provenance --access public
+      - name: Publish npm with trusted publishing
+        if: env.NPM_TOKEN == ''
+        run: npm publish --provenance --access public