ci(release): publish to npm with OIDC trusted publishing and provenance #6

What to build

Add .github/workflows/release.yml, which publishes @developerz.ai/claudes to public npm with OIDC trusted publishing and provenance. Part of epic developerz-ai/multi-ai-router#210.

Adapt it from developerz-ai/ai-task-master's .github/workflows/release.yml:

• trigger release: types: [published] (:19);
• id-token: write (:30);
• serialized, and never cancelled mid-publish (:22);
• npm publish --access public --provenance from the build output.

npm pin. The source pins npm 11.5.2 (:51) because "npm 11.6.x regressed the provenance path… Cannot find module 'sigstore'" (:45-47). npm's latest is 12.2.0 (npm view npm version, 2026-10-14). Check whether 12.x fixed that regression, pin the newest version that works, and put the reason in a comment.

The workflow merges inert: nothing publishes until the first GitHub release, which #7 (HITL) cuts once the package exists on npm.

Acceptance criteria

• Gates green: lint, typecheck, tests, build.
• actionlint is clean on the workflow.
• A dry run (npm publish --dry-run --provenance in a workflow_dispatch job, or locally without provenance) shows the tarball holds only dist/claudes.js, package.json, README.md and LICENSE.

AFK / HITL

AFK.

Affected stack(s)

This repo: .github/workflows/release.yml.

Blocked by

#1

Parent

developerz-ai/multi-ai-router#210

Verified against

• e43fe4cf5d6399e91d2585c3847a376b745230f9 (developerz-ai/claudes main)
• 6a428f1a9965fdbc37b30096a80b04015271f0f4 (developerz-ai/ai-task-master main)