feat: release pipeline, packages, yarn upgrade

.github/workflows/publish.yml

@@ -1,3 +1,4 @@
+---
 name: Publish
 
 on:
@@ -7,6 +8,9 @@ on:
 
 permissions: read-all
 
+env:
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
 jobs:
   Linter:
     name: Lint
@@ -16,17 +20,24 @@ jobs:
       statuses: write
       contents: read
       packages: read
+      issues: write
+      pull-requests: write
 
     steps:
       - name: Run PR Lint
         # https://github.com/ivuorinen/actions
-        uses: ivuorinen/actions/pr-lint@fbbb487332f2b01379192eecb73f7252f1cc54d4 # v2025.11.30
+        uses: ivuorinen/actions/pr-lint@a52399cf74eac2b0963591ab2c6c8eb0f7f50b2d # v2025.12.05
 
   publish:
     name: Publish
     runs-on: ubuntu-latest
     needs:
       - Linter
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
 
     steps:
       - name: Checkout
@@ -38,13 +49,13 @@ jobs:
         uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           always-auth: true
-          node-version-file: '.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
-          scope: '@ivuorinen'
+          node-version-file: ".nvmrc"
+          registry-url: "https://registry.npmjs.org"
+          scope: "@ivuorinen"
 
       - name: Install and enable corepack
         shell: sh
-        run: npm install -g corepack@latest --force && corepack enable
+        run: npm install -g corepack --force && corepack enable
 
       - name: Cache Node Modules
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
@@ -58,9 +69,8 @@ jobs:
         if: steps.cache.outputs.cache-hit != 'true'
         run: yarn install
 
-      - name: Release
-        shell: bash
+      - name: Semantic Release
+        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PAT }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: yarn run semantic-release