fix(ci): split release.yml into version + publish jobs (#1836)

.github/workflows/release.yml

@@ -1,9 +1,5 @@
 name: Release
 
-permissions:
-    contents: write
-    pull-requests: write
-
 on:
     push:
         branches:
@@ -12,9 +8,47 @@ on:
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
-    release:
-        name: Release
+    version:
+        name: Version
         runs-on: ubuntu-latest
+        permissions:
+            contents: write
+            pull-requests: write
+        outputs:
+            hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
+        steps:
+            - uses: actions/checkout@v6
+
+            - name: Install pnpm
+              uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+              with:
+                  run_install: false
+
+            - name: Setup Node.js
+              uses: actions/setup-node@v6
+              with:
+                  node-version: 24
+                  cache: pnpm
+                  cache-dependency-path: pnpm-lock.yaml
+
+            - name: Install dependencies
+              run: pnpm install
+
+            - name: Create or update Version Packages PR
+              id: changesets
+              uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
+
+    publish:
+        name: Publish
+        needs: version
+        if: needs.version.outputs.hasChangesets == 'false'
+        runs-on: ubuntu-latest
+        environment: release
+        permissions:
+            contents: write
+            id-token: write
         steps:
             - uses: actions/checkout@v6
 
@@ -34,12 +68,12 @@ jobs:
             - name: Install dependencies
               run: pnpm install
 
-            - name: Create Release Pull Request or Publish to npm
-              id: changesets
+            - name: Publish to npm
               uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1
               with:
-                  publish: pnpm run build:all && pnpm changeset publish
+                  publish: pnpm run ci:publish
               env:
                   GITHUB_TOKEN: ${{ github.token }}
                   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
                   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+                  NPM_CONFIG_PROVENANCE: 'true'

package.json

@@ -29,6 +29,7 @@
         "docs:check": "typedoc",
         "typecheck:all": "pnpm -r typecheck",
         "build:all": "pnpm -r build",
+        "ci:publish": "pnpm run build:all && pnpm changeset publish",
         "prepack:all": "pnpm -r prepack",
         "lint:all": "pnpm sync:snippets --check && pnpm -r lint",
         "lint:fix:all": "pnpm sync:snippets && pnpm -r lint:fix",