Adopt issue-driven development with automated release publishing

[firejune]

Goal

Bring this repo to the same operating model as sibling packages (e.g. spine-html):

• Open items live as GitHub issues — known gaps, deferred work, and roadmap items are filed here and closed with Closes #N commits/PRs (issues AssetRestorer.release(path) — revoke and cache eviction as one operation #1–Font format support (WOFF2/WOFF) #8 already follow this).
• Releases are cut by automation, not by hand: a release-please (or equivalent) workflow opens the release PR, and merging it publishes to npm via Trusted Publishing (OIDC — no long-lived npm tokens in the repo).
• End state: an automation agent can pick up an issue, resolve it on a branch, open a PR, and the merge triggers the release pipeline — maintainer involvement reduced to review/merge.

Steps

1. Add a GitHub-hosted release workflow (release-please or equivalent) covering both published packages in this repo.
2. Configure npm Trusted Publishing for the published package(s) on npmjs.com (maintainer action — the npm-side form must be filled by the package owner).
3. Enable the repo setting that allows Actions to create pull requests (required for the release PR).
4. Retire manual npm publish once the pipeline has cut one verified release.

Notes

• v0.1.3 history was reconstructed and tagged (v0.1.3), so the repo is now release-ready: the tree byte-matches the published dist.
• Trusted Publishing requires GitHub-hosted runners (it does not work from self-hosted runners) — keep the release job on ubuntu-latest.

[firejune]

Pipeline landed on main in f2d5544 (ci: adopt release-please with npm trusted publishing):

• .github/workflows/release.yml — release-please in manifest mode over both packages (node-workspace plugin: a core release bumps the plugin's dependency range and releases it too), then npm publish --provenance over OIDC, core before plugin. No npm token anywhere.
• .github/workflows/ci.yml — build + vitest on every push and PR (first run is green).
• release-please-config.json / .release-please-manifest.json — bootstrapped at the published 0.1.3; bootstrap-sha pinned to the v0.1.3 commit. Tags headerless-v0.1.3 and vite-plugin-headerless-v0.1.3 were added at that commit so release-please has its per-component anchors (future tags follow that naming).
• RELEASING.md — the loop, the one-time setup, and the manual fallback.
• Repo setting Allow GitHub Actions to create and approve pull requests is now enabled (verified via API).

Remaining before the first automated cut (maintainer, npmjs.com — step 2 of this issue):

Trusted Publisher form, filled identically for headerless and vite-plugin-headerless:

Field	Value
Organization or user	firejune
Repository	headerless
Workflow filename	release.yml
Environment name	leave blank

Then land the next feat/fix on main, merge the release PR it opens, and watch the publish steps — the first automated release proves the OIDC exchange end to end, after which this issue can close (step 4).

[firejune]

Status: the release flow is now zero-touch on the GitHub side, proven live — but the first npm publish is blocked on the registry-side trusted publisher, so this stays open.

What ran hands-free (release PR #11, today):

• ci: drive the release PR to a tested merge without a PAT #12 landed the driver: the release run now dispatches ci.yml onto the release branch to satisfy the required test check, squash-merges the release PR, and dispatches a fresh release.yml run for the tag-and-publish half (a GITHUB_TOKEN merge push starts no workflows). Daily scheduled sweep as the safety net. No PAT, no new credential.
• The push that merged ci: drive the release PR to a tested merge without a PAT #12 drove release: main #11 with zero clicks: test satisfied → bot squash-merge → handoff run 32635710200 tagged headerless-v0.2.0 / vite-plugin-headerless-v0.1.4 and cut both GitHub releases.

What failed, twice, at the very last step:

1. npm error 404 on the PUT — setup-node's registry-url wrote an .npmrc whose placeholder _authToken preempted the OIDC exchange. Fixed in ci: drop registry-url so npm publish reaches the OIDC exchange #13.
2. After the fix, republish run 32636504691 (via the republish lever from ci: add a republish lever for tagged releases whose publish failed #14) failed ENEEDAUTH: npm minted its OIDC token but found no trusted publisher at the registry to exchange it with.

The one remaining step is owner-side (RELEASING.md, "The registry side"): on npmjs.com, add the Trusted Publisher for both headerless and vite-plugin-headerless — user firejune, repository headerless, workflow release.yml, environment blank. Then, no code changes needed:

gh workflow run release.yml --ref main -f republish=headerless-v0.2.0
gh workflow run release.yml --ref main -f republish=vite-plugin-headerless-v0.1.4

and npm view headerless@0.2.0 / npm view vite-plugin-headerless@0.1.4 should confirm. Every release after that needs nothing at all.

[firejune]

Verified end to end: the automated chain (release PR #11 → dispatched test check → bot squash-merge → tags headerless-v0.2.0 / vite-plugin-headerless-v0.1.4 + GitHub releases) completed with zero manual clicks, and after the registry-side trusted publisher connections were restored, the republish dispatches published both packages over OIDC — runs 32637144634 and 32637148725, both green. Registry now serves headerless@0.2.0 and vite-plugin-headerless@0.1.4 as latest. Every step of this issue's plan is done; manual npm publish is retired.