Add release workflow, upgrade CI deps

.github/workflows/ci.yml

@@ -13,13 +13,13 @@ jobs:
         node-version:
           - 20
           - 26 # Node.js 26 support Uint8Array.fromBase64()
-          - '*'
+          - latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
-      - run: npm install
+      - run: npm ci
       - run: npm test
       - uses: codecov/codecov-action@v5
         with:

.github/workflows/release.yml

@@ -0,0 +1,28 @@
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+permissions:
+  id-token: write # Required for NPM trusted publishing.
+  contents: read
+
+jobs:
+  npm:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: latest
+      - run: npm ci --ignore-scripts
+      - run: npm test
+      - run: npm stage publish # Runs prepublish script.

.gitignore

@@ -1,6 +1,5 @@
 coverage
 node_modules
 npm-debug.log
-package-lock.json
 dist/
-*.tsbuildinfo
+*.tsbuildinfo