ci: add PR workflow, make release fail loudly when registry is unreachable, document setup

.github/workflows/release.yml

@@ -5,12 +5,22 @@ on:
     branches:
       - main
 
+# Requires two repo secrets:
+#   NPM_REGISTRY_URL - full URL of the Verdaccio registry, reachable FROM THE RUNNER.
+#                      Not set yet: the registry currently listens on 127.0.0.1:4873 on
+#                      the dev server and the firewall allows only 80/443/SSH, so no
+#                      external runner can reach it. Until that is resolved this job
+#                      will fail at the publish step by design, rather than silently
+#                      skipping the release. See docs/PACKAGE-EXTRACTION.md in the
+#                      marketplaces repo.
+#   NPM_TOKEN        - publish token for that registry (npm login --registry=<url>).
+
 jobs:
   release:
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      id-token: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -22,7 +32,6 @@ jobs:
         with:
           node-version: 20
           cache: npm
-          registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
         run: npm ci
@@ -33,6 +42,21 @@ jobs:
       - name: Test
         run: npm test
 
+      - name: Configure registry auth
+        run: |
+          if [ -z "${{ secrets.NPM_REGISTRY_URL }}" ] || [ -z "${{ secrets.NPM_TOKEN }}" ]; then
+            echo "NPM_REGISTRY_URL and/or NPM_TOKEN are not set on this repo."
+            echo "The registry is not reachable from CI yet - see the comment at the top of this file."
+            exit 1
+          fi
+          REGISTRY="${{ secrets.NPM_REGISTRY_URL }}"
+          HOST_PATH="${REGISTRY#http://}"
+          HOST_PATH="${HOST_PATH#https://}"
+          {
+            echo "@marketplaces:registry=${REGISTRY}"
+            echo "//${HOST_PATH%/}/:_authToken=${{ secrets.NPM_TOKEN }}"
+          } >> .npmrc
+
       - name: Create release PR or publish
         uses: changesets/action@v1
         with:
@@ -40,4 +64,3 @@ jobs:
           publish: npm run release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}