chore: release via GitHub Actions with staged publishing

.github/workflows/release.yml

@@ -0,0 +1,39 @@
+name: release
+
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: read
+
+jobs:
+  npm:
+    name: publish-to-npm
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version-file: .tool-versions
+          registry-url: 'https://registry.npmjs.org'
+          cache: pnpm
+
+      - run: npm install -g npm@11.17.0
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm run build
+
+      - name: Publish to npm
+        run: npm stage publish --provenance --access public

AGENTS.md

@@ -86,6 +86,15 @@ Run the quality gates first. Then check:
 Verdict: **approve** / **request changes** / **needs human decision**.
 Rank findings by severity: `blocker` / `bug` / `risk` / `nit`.
 
+## Release
+
+1. On `main`: `pnpm run release` (`np --no-publish` — bumps the version,
+   tags, pushes, and creates a GitHub release). It is interactive, so a
+   human runs it in a terminal
+2. The tag push triggers the `release` workflow, which stages the
+   package on npm with staged publishing
+3. A maintainer approves the staged package on npmjs.com (needs 2FA)
+
 ## Hono Documentation
 
 Need Hono details? Fetch <https://hono.dev/llms.txt> or a page under

package.json

@@ -17,7 +17,7 @@
     "format:fix": "prettier src --write",
     "postbuild": "publint",
     "prerelease": "pnpm run build",
-    "release": "np"
+    "release": "np --no-publish"
   },
   "files": [
     "dist"