CLI-038 — Add protected release automation for npm and GitHub Releases

[dDevAhmed]

Summary

Implement the release workflow after the package name, Changesets integration, CI/security gates, and publication readiness are established.

Scope

• Changesets release PR automation;
• protected package publication path;
• Git tag/GitHub Release creation/verification;
• npm Trusted Publishing/OIDC where supported;
• provenance where supported;
• release-environment/permission hardening.

Security Requirements

Do not use long-lived npm tokens when trusted publishing is available. Never run publication from untrusted PR code. Keep workflow permissions least-privilege and review third-party Actions.

Acceptance Criteria

• release PR flow updates package version/changelog correctly;
• package publication occurs only from approved protected context;
• Git tag/GitHub Release align with package version;
• OIDC/trusted publishing and provenance are used where supported;
• dry-run/test strategy exists before first real publish;
• rollback/hotfix guidance is documented.

Dependencies

• CLI-001
• CLI-009 through CLI-015
• CLI-010 specifically
• package publication name/registry readiness

---

🏷 Labels

• type: ci
• area: release
• priority: P0
• difficulty: expert
• security-sensitive
• supply-chain