feat: v1.0.0 hardening

.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun install --frozen-lockfile
+      - run: bun run typecheck
+      - run: bun run lint
+      - run: bun run build
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        react: [18, 19]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun install --frozen-lockfile
+      - name: Pin React ${{ matrix.react }}
+        if: matrix.react == 18
+        run: bun add --cwd packages/hamo -d react@18 react-dom@18 @types/react@18 @types/react-dom@18
+      - run: bun run test

.github/workflows/publish.yml

@@ -1,29 +1,38 @@
-name: Publish to NPM
+name: Publish to npm
+
 on:
   release:
     types: [created]
+
+permissions:
+  contents: read
+  id-token: write # required for npm provenance + trusted publishing (OIDC)
+
 jobs:
-  build:
+  publish:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
-      - name: Setup Node
-        uses: actions/setup-node@v3
+      - uses: oven-sh/setup-bun@v2
         with:
-          node-version: 16
-          registry-url: 'https://registry.npmjs.org'
+          bun-version: latest
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@v2
+      - uses: actions/setup-node@v4
         with:
-          version: 7
-          run_install: false
-
-      - name: Install dependencies and build
-        run: pnpm i --frozen-lockfile
-      - name: Publish package on NPM
-        run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          node-version: 20
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: bun install --frozen-lockfile
+      - run: bun run typecheck
+      - run: bun run lint
+      - run: bun run test
+      - run: bun run build
+
+      # Trusted publishing (OIDC) needs npm >= 11.5.1; node 20 ships npm 10.
+      - run: npm install -g npm@latest
+
+      # No NODE_AUTH_TOKEN: npm authenticates to the registry via the OIDC
+      # token from `id-token: write`, using the trusted publisher configured
+      # on the hamo package settings. Provenance is attached automatically.
+      - run: cd packages/hamo && npm publish --provenance --access public

.gitignore

@@ -2,4 +2,5 @@ node_modules
 .DS_Store
 dist
 bundled
-bun.lock
+plans
+.claude/settings.local.json