ci: publish sim-skills to npm on merge to main - #15

Summary

Publishes sim-skills to npm automatically on every qualifying merge to main, mirroring simstudioai/sim's publish-sim-setup.yml.

• .github/workflows/publish.yml: on push to main (package, lockfile, src/, skills/, scripts/, plugin manifests, tsconfig, or the workflow itself).
  • build: install, auto-bump the version (scripts/resolve-release-version.ts), sync both plugin manifests to it, validate skills, test, type-check, build, bun pm pack --ignore-scripts, verify tarball contents and that all three packed manifests carry the release version, refuse an already-published version, and upload the tarball.
  • publish: id-token: write only, Node 24, npm publish <tgz> --access public --tag latest through trusted publishing (OIDC, no token). It runs no repository code.
  • release: contents: write, creates tag v<version> and a GitHub Release (--generate-notes --latest). It skips if the release already exists, so a re-run is safe.
• Version rule: if npm has no stable versions, use the package.json version, so the first automated release is 0.1.1. Otherwise use package.json when it is ahead of npm, or the highest published stable version plus one patch. Prereleases are ignored. A registry error other than 404 fails the run.
• ci.yml: actions pinned to SHAs, persist-credentials: false, and a new check:plugin-version step that fails when either plugin.json version differs from package.json. The tarball check moved to scripts/verify-package.sh so CI and publish share it.
• README: real npm install wording and a short Releasing section.

All action SHAs match the sim workflow. oven-sh/setup-bun is pinned to v2.2.0 (0c5077e).

One-time setup before the first run

1. A maintainer publishes sim-skills to npm once by hand to claim the name. Trusted publishing can only be set up on a package that already exists. If that publishes 0.1.1, the first automated run will publish 0.1.2.
2. On npmjs.com, go to sim-skills → Settings → Trusted Publisher → GitHub Actions and enter: organization simstudioai, repository skills, workflow publish.yml.
3. Optional: after the first OIDC publish succeeds, set publishing access to disallow tokens.

Until steps 1 and 2 are done, a merge to main will fail at the publish step. Nothing is published, and no tag or release is created.

Testing

• bun install --frozen-lockfile, check:skills, check:plugin-version, test (16 passing), type-check, build, lint:check, pack + verify-package.sh, actionlint: all pass locally.
• New tests cover these failure modes: nothing published, manifest ahead, manifest behind or equal, prereleases ignored, non-stable manifest rejected, registry 404 vs 5xx, and plugin-version drift. Removing each branch of the resolver turns its test red.
• bun run release:version against the live registry resolves 0.1.1 -> 0.1.1 (sim-skills is a 404 today).