ci: CI pipeline and changesets-driven release to npm

.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets).
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md).

.changeset/config.json

@@ -0,0 +1,12 @@
+{
+    "$schema": "https://unpkg.com/@changesets/config@3.1.4/schema.json",
+    "changelog": ["@changesets/changelog-github", { "repo": "AStaroverov/webactor" }],
+    "commit": false,
+    "fixed": [],
+    "linked": [],
+    "access": "public",
+    "baseBranch": "main",
+    "updateInternalDependencies": "patch",
+    "privatePackages": { "version": false, "tag": false },
+    "ignore": []
+}

.github/actions/setup/action.yml

@@ -0,0 +1,22 @@
+name: Setup
+description: Install pnpm, Node.js and workspace dependencies
+
+inputs:
+    registry-url:
+        description: npm registry to configure Node.js for
+        required: false
+        default: ''
+
+runs:
+    using: composite
+    steps:
+        - uses: pnpm/action-setup@v6
+
+        - uses: actions/setup-node@v7
+          with:
+              node-version-file: .node-version
+              registry-url: ${{ inputs.registry-url }}
+              cache: pnpm
+
+        - run: pnpm install --frozen-lockfile
+          shell: bash

.github/workflows/ci.yml

@@ -0,0 +1,66 @@
+name: CI
+
+on:
+    pull_request:
+    push:
+        branches: [main]
+
+concurrency:
+    group: ci-${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+
+jobs:
+    check:
+        name: Lint, format, build
+        runs-on: ubuntu-latest
+        timeout-minutes: 15
+        steps:
+            - uses: actions/checkout@v7
+            - uses: ./.github/actions/setup
+            - run: pnpm lint
+            - run: pnpm format:check
+            - run: pnpm build
+
+    unit:
+        name: Unit tests
+        runs-on: ubuntu-latest
+        timeout-minutes: 15
+        steps:
+            - uses: actions/checkout@v7
+            - uses: ./.github/actions/setup
+            - run: pnpm test:unit
+
+    e2e:
+        name: E2E tests
+        runs-on: ubuntu-latest
+        timeout-minutes: 45
+        steps:
+            - uses: actions/checkout@v7
+            - uses: ./.github/actions/setup
+            - run: pnpm --filter webactor exec playwright install --with-deps chromium
+            - run: pnpm test:e2e
+            - uses: actions/upload-artifact@v7
+              if: failure()
+              with:
+                  name: e2e-results
+                  path: packages/webactor/test-results/
+                  retention-days: 7
+
+    devtools:
+        name: DevTools tests
+        runs-on: ubuntu-latest
+        timeout-minutes: 20
+        steps:
+            - uses: actions/checkout@v7
+            - uses: ./.github/actions/setup
+            - run: pnpm --filter webactor-devtools exec playwright install --with-deps chromium
+            - run: pnpm test:devtools
+            - uses: actions/upload-artifact@v7
+              if: failure()
+              with:
+                  name: devtools-results
+                  path: packages/devtools/test-results/
+                  retention-days: 7

.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: Release
+
+on:
+    push:
+        branches: [main]
+
+concurrency:
+    group: release
+    cancel-in-progress: false
+
+permissions:
+    contents: read
+
+jobs:
+    release:
+        name: Version or publish
+        runs-on: ubuntu-latest
+        timeout-minutes: 20
+        permissions:
+            contents: write
+            pull-requests: write
+            id-token: write
+        steps:
+            - uses: actions/checkout@v7
+              with:
+                  fetch-depth: 0
+
+            - uses: ./.github/actions/setup
+              with:
+                  registry-url: https://registry.npmjs.org
+
+            - run: pnpm test:unit
+
+            - uses: changesets/action@v1
+              with:
+                  version: pnpm version:packages
+                  publish: pnpm release
+                  commit: 'chore(release): version packages'
+                  title: 'chore(release): version packages'
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -5,3 +5,6 @@
 **/test-results/
 **/playwright-report/
 *.zip
+
+packages/webactor/README.md
+packages/webactor/LICENSE

.node-version

@@ -0,0 +1 @@
+26.5.0

CONTRIBUTING.md

@@ -0,0 +1,69 @@
+# Contributing
+
+## Setup
+
+```bash
+pnpm install
+```
+
+Node version is pinned in [`.node-version`](./.node-version); pnpm version in `packageManager`.
+
+## Checks
+
+Everything CI runs, you can run locally:
+
+```bash
+pnpm lint
+pnpm format:check    # pnpm format to fix
+pnpm build           # includes tsc --noEmit for every package
+pnpm test:unit
+pnpm test:e2e
+pnpm test:devtools
+```
+
+## Releasing
+
+Versioning and publishing are driven by [changesets](https://github.com/changesets/changesets). Nobody edits
+`version` in `package.json` by hand and nobody runs `npm publish` locally.
+
+### 1. Describe the change in your PR
+
+```bash
+pnpm changeset
+```
+
+Pick `webactor`, pick patch / minor / major, write one line for the changelog. Commit the generated
+`.changeset/*.md` file together with your code.
+
+A PR without a changeset is fine when nothing user-facing changed (docs, CI, tests, examples, devtools).
+
+### 2. Merge to `main`
+
+The [Release workflow](./.github/workflows/release.yml) sees pending changesets and opens (or updates) a
+**`chore(release): version packages`** PR. That PR contains the version bump, the consumed changeset files and
+the generated `CHANGELOG.md`.
+
+### 3. Merge the version PR
+
+Merging it makes the same workflow run `pnpm release` — build, then `changeset publish`, which publishes
+`webactor` to npm, creates the git tag and the GitHub Release.
+
+`webactor-devtools` is `private` and is never published; changesets ignores it.
+
+### npm authentication
+
+Publishing uses npm [trusted publishing](https://docs.npmjs.com/trusted-publishers/) — OIDC, no token stored in
+the repository. The workflow requests `id-token: write` and npm verifies the workflow identity, so releases get a
+provenance attestation automatically.
+
+One-time setup on npmjs.com → package `webactor` → Settings → Trusted publisher:
+
+| Field           | Value                |
+| --------------- | -------------------- |
+| Publisher       | GitHub Actions       |
+| Organization    | `AStaroverov`        |
+| Repository      | `webactor`           |
+| Workflow        | `release.yml`        |
+| Environment     | _(leave empty)_      |
+
+Until that is configured the publish step fails with a 404 from the registry.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Alexandr Staroverov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,5 +1,8 @@
 # webactor
 
+[![CI](https://github.com/AStaroverov/webactor/actions/workflows/ci.yml/badge.svg)](https://github.com/AStaroverov/webactor/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/webactor.svg)](https://www.npmjs.com/package/webactor)
+
 **Actor-model architecture for the browser.** One programming model for every boundary in your app — components, tabs, and Web Workers — built on plain message passing.
 
 ```ts
@@ -219,4 +222,6 @@ webactor is a _model_, not just an RPC shim: you adopt actors, envelopes, and su
 
 ## Status
 
-`1.0.0` · single-maintainer project · MIT-style usage. The API described here is exercised by the test suite (`pnpm test`). Feedback and issues welcome on the [repository](https://github.com/AStaroverov/actorr).
+Single-maintainer project · [MIT](./LICENSE). The API described here is exercised by the test suite (`pnpm test`). Feedback and issues welcome on the [repository](https://github.com/AStaroverov/webactor).
+
+Releases are automated with [changesets](https://github.com/changesets/changesets) — see [CONTRIBUTING.md](./CONTRIBUTING.md) for how to land a change and cut a version.

package.json

@@ -13,9 +13,14 @@
         "lint": "oxlint",
         "lint:fix": "oxlint --fix",
         "format": "oxfmt",
-        "format:check": "oxfmt --check"
+        "format:check": "oxfmt --check",
+        "changeset": "changeset",
+        "version:packages": "changeset version && pnpm install --lockfile-only",
+        "release": "pnpm build && changeset publish"
     },
     "devDependencies": {
+        "@changesets/changelog-github": "^0.7.0",
+        "@changesets/cli": "^2.31.1",
         "oxfmt": "^0.60.0",
         "oxlint": "^1.75.0",
         "typescript": "^7.0.2"

packages/devtools/PRIVACY.md

@@ -15,7 +15,7 @@ popup or from the bar inside the panel — the extension cannot read anything at
 one origin and can be withdrawn at any time from the same popup, or from the extension's card in
 `chrome://extensions`.
 
-On an allowed page, the extension reads what the [webactor](https://github.com/AStaroverov/actorr)
+On an allowed page, the extension reads what the [webactor](https://github.com/AStaroverov/webactor)
 library reports about itself:
 
 - names, kinds and lifecycle of actors, supervisors and channels;
@@ -54,9 +54,9 @@ runtime.
 
 ## Source
 
-The extension is open source: <https://github.com/AStaroverov/actorr/tree/main/packages/devtools>.
+The extension is open source: <https://github.com/AStaroverov/webactor/tree/main/packages/devtools>.
 Everything described here is verifiable in that code.
 
 ## Contact
 
-Open an issue at <https://github.com/AStaroverov/actorr/issues>.
+Open an issue at <https://github.com/AStaroverov/webactor/issues>.

packages/devtools/STORE.md

@@ -13,9 +13,9 @@ step with the manifest: if a permission changes, its justification here changes
 | Visibility        | Public                                                                       |
 | Distribution      | All regions                                                                  |
 | Package           | `pnpm --filter webactor-devtools zip` → `webactor-devtools-<version>.zip`    |
-| Privacy policy    | https://github.com/AStaroverov/actorr/blob/main/packages/devtools/PRIVACY.md |
-| Homepage          | https://github.com/AStaroverov/actorr/tree/main/packages/devtools            |
-| Support           | https://github.com/AStaroverov/actorr/issues                                 |
+| Privacy policy    | https://github.com/AStaroverov/webactor/blob/main/packages/devtools/PRIVACY.md |
+| Homepage          | https://github.com/AStaroverov/webactor/tree/main/packages/devtools            |
+| Support           | https://github.com/AStaroverov/webactor/issues                                 |
 
 ## Short description
 
@@ -55,7 +55,7 @@ step with the manifest: if a permission changes, its justification here changes
 > is sent anywhere: the data lives in your DevTools and dies with it.
 >
 > The extension is open source, and so is the library it inspects:
-> https://github.com/AStaroverov/actorr
+> https://github.com/AStaroverov/webactor
 
 ## Single purpose
 

packages/devtools/manifest.json

@@ -2,7 +2,7 @@
     "manifest_version": 3,
     "name": "webactor devtools",
     "description": "Inspect webactor actor graphs, connections and message flow",
-    "homepage_url": "https://github.com/AStaroverov/actorr/tree/main/packages/devtools",
+    "homepage_url": "https://github.com/AStaroverov/webactor/tree/main/packages/devtools",
     "minimum_chrome_version": "111",
     "devtools_page": "devtools.html",
     "background": {

packages/devtools/package.json

@@ -2,12 +2,14 @@
     "name": "webactor-devtools",
     "description": "Chrome DevTools panel for inspecting webactor actor graphs and message flow",
     "version": "0.1.0",
+    "private": true,
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/AStaroverov/actorr.git",
+        "url": "git+https://github.com/AStaroverov/webactor.git",
         "directory": "packages/devtools"
     },
     "author": "AStaroverov",
+    "license": "MIT",
     "type": "module",
     "files": [
         "dist"