ci: add CI checks and release-please releases

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: check (node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [20, 22, 24]
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      - run: npm ci
+
+      # Typecheck, build, tests, and a dry-run pack of the published files.
+      - run: npm run check

.github/workflows/publish.yml

@@ -1,9 +1,17 @@
-name: Publish to npm
+name: Release
 
-# Publishing is driven by GitHub Releases: creating a release for tag v0.2.0
-# publishes 0.2.0. The tag and package.json must agree, which the job checks
-# before it touches the registry.
+# Every push to main updates a release PR maintained by release-please. Merging
+# that PR bumps package.json, writes CHANGELOG.md, tags vX.Y.Z, creates the
+# GitHub Release, and publishes the package below.
+#
+# A release published by hand also publishes. Releases that release-please
+# creates with GITHUB_TOKEN do not trigger the `release` event, so nothing is
+# published twice.
+#
+# Keep this file name: npm trusted publishing is bound to it.
 on:
+  push:
+    branches: [main]
   release:
     types: [published]
   workflow_dispatch:
@@ -15,17 +23,48 @@ on:
 
 permissions:
   contents: read
-  # Required for npm provenance and for trusted publishing.
-  id-token: write
+
+concurrency:
+  group: release
+  cancel-in-progress: false
 
 jobs:
+  release-please:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+
+    steps:
+      - uses: googleapis/release-please-action@v5
+        id: release
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
   publish:
+    needs: release-please
+    # release-please is skipped for release and dispatch events; run anyway.
+    if: >-
+      !cancelled() && (
+        needs.release-please.outputs.release_created == 'true' ||
+        github.event_name == 'release' ||
+        github.event_name == 'workflow_dispatch'
+      )
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # Required for npm provenance and for trusted publishing.
+      id-token: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org
@@ -36,21 +75,21 @@ jobs:
       - run: npm ci
 
       - name: Verify the tag matches package.json
-        if: github.event_name == 'release'
+        if: github.event_name != 'workflow_dispatch'
+        env:
+          TAG: ${{ needs.release-please.outputs.tag_name || github.ref_name }}
         run: |
-          tag="${GITHUB_REF_NAME#v}"
           version="$(node -p 'require("./package.json").version')"
-          if [ "$tag" != "$version" ]; then
-            echo "Tag $GITHUB_REF_NAME does not match package.json version $version" >&2
+          if [ "${TAG#v}" != "$version" ]; then
+            echo "Tag $TAG does not match package.json version $version" >&2
             exit 1
           fi
 
       - run: npm run check
 
       - name: Publish
-        if: github.event_name == 'release'
+        if: github.event_name != 'workflow_dispatch' || !inputs.dry-run
         run: npm publish --provenance --access public
         env:
-          # Ignored once trusted publishing is configured on npmjs.com; keep it
-          # until then, because the very first publish cannot use OIDC.
+          # Ignored once trusted publishing is configured on npmjs.com.
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.2.1"
+}

CHANGELOG.md

@@ -0,0 +1,17 @@
+# Changelog
+
+## [0.2.1](https://github.com/eiserv/squircles/compare/v0.2.0...v0.2.1) (2026-10-05)
+
+
+### Bug Fixes
+
+* **dom:** stop Squircle hosts from re-syncing every frame ([60ff50e](https://github.com/eiserv/squircles/commit/60ff50e6535105cd0c2df78402ffeac3acc0b58e))
+
+## [0.2.0](https://github.com/eiserv/squircles/releases/tag/v0.2.0) (2026-07-29)
+
+First release on npm.
+
+
+### ⚠ BREAKING CHANGES
+
+* `Squircle` is driven by CSS and works on any element; see the migration notes in the README.

README.md

@@ -247,3 +247,10 @@ writes a static rasterization fixture to `.artifacts/`.
 
 See [docs/architecture.md](docs/architecture.md) for the rendering rationale
 and constraints.
+
+### Releasing
+
+Commits on `main` follow [Conventional Commits](https://www.conventionalcommits.org/).
+release-please keeps a release PR open that bumps the version and updates
+[CHANGELOG.md](CHANGELOG.md); merging it tags the release, creates the GitHub
+Release, and publishes to npm.

release-please-config.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "node",
+  "include-component-in-tag": false,
+  "bump-minor-pre-major": true,
+  "packages": {
+    ".": {}
+  }
+}