ci: add PR workflow, make release fail loudly when registry is unreachable, document setup

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches-ignore:
+      - main
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm test
+
+      - name: Require a changeset
+        run: |
+          if [ -z "$(ls -A .changeset/*.md 2>/dev/null | grep -v README)" ]; then
+            echo "No changeset found. Run 'npx changeset' and commit the result so this change gets a version bump."
+            exit 1
+          fi

.github/workflows/release.yml

@@ -5,12 +5,22 @@ on:
     branches:
       - main
 
+# Requires two repo secrets:
+#   NPM_REGISTRY_URL - full URL of the Verdaccio registry, reachable FROM THE RUNNER.
+#                      Not set yet: the registry currently listens on 127.0.0.1:4873 on
+#                      the dev server and the firewall allows only 80/443/SSH, so no
+#                      external runner can reach it. Until that is resolved this job
+#                      will fail at the publish step by design, rather than silently
+#                      skipping the release. See docs/PACKAGE-EXTRACTION.md in the
+#                      marketplaces repo.
+#   NPM_TOKEN        - publish token for that registry (npm login --registry=<url>).
+
 jobs:
   release:
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      id-token: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -22,7 +32,6 @@ jobs:
         with:
           node-version: 20
           cache: npm
-          registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
         run: npm ci
@@ -33,6 +42,21 @@ jobs:
       - name: Test
         run: npm test
 
+      - name: Configure registry auth
+        run: |
+          if [ -z "${{ secrets.NPM_REGISTRY_URL }}" ] || [ -z "${{ secrets.NPM_TOKEN }}" ]; then
+            echo "NPM_REGISTRY_URL and/or NPM_TOKEN are not set on this repo."
+            echo "The registry is not reachable from CI yet - see the comment at the top of this file."
+            exit 1
+          fi
+          REGISTRY="${{ secrets.NPM_REGISTRY_URL }}"
+          HOST_PATH="${REGISTRY#http://}"
+          HOST_PATH="${HOST_PATH#https://}"
+          {
+            echo "@marketplaces:registry=${REGISTRY}"
+            echo "//${HOST_PATH%/}/:_authToken=${{ secrets.NPM_TOKEN }}"
+          } >> .npmrc
+
       - name: Create release PR or publish
         uses: changesets/action@v1
         with:
@@ -40,4 +64,3 @@ jobs:
           publish: npm run release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}