👷‍♀️ Move publishing inside single workflow

At the moment, we have two Github Action workflows:

  - `test.yml`: runs build and test, then tags when bumping the version
    in `main`
  - `publish.yml`: releases the package when a new tag is published

The issue with this setup is that the built-in `GITHUB_TOKEN`
[will not trigger another workflow][1], so we had to add a separate
PAT with write permissions to our repos, which was a bit of a
security concern.

In order to avoid the need for this extra token, with its associated
risks and administrative overheads (like rotating), this change
combines our workflows into a single workflow.

We tweak the `tag.sh` to `release.sh`, and it's now also in charge of
publishing (since it knows when we've pushed a new tag).

[1]: https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow

.github/workflows/ci.yml

@@ -0,0 +1,29 @@
+name: CI
+
+on:
+  push:
+    branches:
+    - main
+  pull_request:
+    branches:
+    - main
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
+      with:
+        node-version: '20.x'
+        registry-url: 'https://npm.pkg.github.com'
+    - name: Install
+      run: npm install
+    - name: Test
+      run: npm test --forbid-only
+    - name: Release
+      if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+      run: ./release.sh
+      env:
+        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

tag.sh → release.sh

@@ -20,3 +20,5 @@ echo '!/lib' >> .gitignore
 
 git tag $VERSION
 git push origin refs/tags/$VERSION
+
+npm publish