link to sidecar #5

	name: release

	on:
	push:
	tags: ["v*"]
	workflow_dispatch:
	inputs:
	dry_run:
	description: "Dry run (skip actual publish)"
	required: false
	default: "false"
	type: choice
	options: ["false", "true"]

	jobs:
	test:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Set up Node.js
	uses: actions/setup-node@v4
	with:
	node-version: "20"
	cache: "npm"

	- name: Install dependencies
	run: npm ci

	- name: Run type check
	run: npm run typecheck

	- name: Run tests
	run: npm test

	publish:
	runs-on: ubuntu-latest
	needs: [test]
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Set up Node.js
	uses: actions/setup-node@v4
	with:
	node-version: "20"
	registry-url: "https://registry.npmjs.org"
	cache: "npm"

	- name: Install dependencies
	run: npm ci

	- name: Build
	run: npm run build

	- name: Validate package version matches tag
	if: startsWith(github.ref, 'refs/tags/v')
	run: \|
	TAG_VERSION="${GITHUB_REF_NAME#v}"
	PKG_VERSION=$(node -p "require('./package.json').version")
	if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
	echo "Tag version ($TAG_VERSION) does not match package.json version ($PKG_VERSION)"
	exit 1
	fi
	echo "Version validated: $PKG_VERSION"

	- name: Publish to npm (dry run)
	if: inputs.dry_run == 'true'
	run: npm publish --dry-run

	- name: Publish to npm
	if: inputs.dry_run != 'true'
	env:
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
	run: npm publish --access public

Provide feedback