Release is done via trusted publishing.
- (once every three months) create token on npmjs.org
- (once every three months) add/update token on the repositories action secrets and variables settings
- release by manually running the release.yml workflow
The release version number is defined by semantic commit messages.