Build: set up CI commit signing #11

	name: Release
	on:
	push:
	branches:
	- main

	permissions:
	attestations: write
	contents: write
	id-token: write
	issues: write
	pull-requests: write

	jobs:
	build:
	name: Release
	runs-on: ubuntu-latest

	steps:
	- name: Git Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- uses: actions/setup-node@v4
	with:
	node-version: "22.x"
	cache: "npm"
	registry-url: "https://registry.npmjs.org"

	- name: NPM install
	run: npm ci

	- name: Test
	run: npm run test

	- name: Compile
	run: npm run compile

	- name: Lint
	run: npm run lint

	- name: Configure Git
	shell: bash
	run: \|
	git config gpg.format ssh
	git config user.signingkey "${SSH_SIGNING_KEY_PUB}"
	git config commit.gpgsign true
	git config user.name "${{ github.actor }}"
	git config user.email "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"

	- name: Add signing key
	shell: bash
	run: \|
	ssh-agent -a "${SSH_AUTH_SOCK}"
	ssh-add - <<< "${SSH_SIGNING_KEY}"
	env:
	SSH_AUTH_SOCK: /tmp/ssh-agent-sock
	SSH_SIGNING_KEY: ${{ secrets.SSH_SIGNING_KEY }}

	- name: Release
	run: npm run release
	env:
	SSH_AUTH_SOCK: /tmp/ssh-agent-sock
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
	NPM_CONFIG_PROVENANCE: true

Provide feedback