[rendis]

Adds a Release workflow so a release no longer depends on a maintainer machine. Today that means tagging by hand, creating the GitHub release, and publishing the Studio packages with the right pnpm version so workspace:* resolves.

How it works

Run it from Actions → Release → Run workflow on main (or through the API). Inputs:

• version: for example 3.4.0. CHANGELOG.md must have a ## [3.4.0] section.
• target: all (default), github (tag + release only), or npm (publish an already tagged version).
• dry_run: defaults to true. It previews the notes and runs npm publish --dry-run, without creating or publishing anything.

Jobs:

1. prepare – requires main, validates the version format, and checks that the CHANGELOG section exists.
2. quality – reuses quality.yml: Go build, vet, race tests and fuzz smoke; Studio lint, typecheck, tests, Stryker dry-run, build and audit. If anything fails, nothing is released.
3. github – creates the annotated tag vX.Y.Z on the commit being released and the GitHub release. The notes are the CHANGELOG section plus the compare link.
4. npm – checks out the tag, builds with pnpm 10.11.0, and packs each Studio package with pnpm pack. Packing rewrites workspace:* to the real version, and the job fails if any workspace: dependency remains. It then publishes with npm publish --provenance, editor-core first.

Every step is idempotent. An existing tag or release is kept, and package versions already on npm are skipped, so a failed run can simply be re-run.

npm Trusted Publishing (no stored token)

The npm job uses OIDC (id-token: write) instead of an NPM_TOKEN secret. One-time setup per package on npmjs.com: open the package's Settings → Trusted Publisher → GitHub Actions and enter:

• Organization: rendis
• Repository: statepro
• Workflow: release.yml

Do this for @rendis/statepro-studio-react and @rendis/statepro-studio-web-component.

Other changes

• quality.yml can now be called as a reusable workflow (workflow_call). Its concurrency group now includes github.workflow, so a push to main cannot cancel the checks of a release run, or the other way round.
• CONTRIBUTING.md gets a Releasing section that describes this process.

Validation

• actionlint reports no issues on both workflows.
• I ran the shell steps locally:
  • Release notes extracted for 3.4.0 match the published v3.4.0 release, apart from blank lines.
  • An unknown version produces no notes.
  • pnpm pack with pnpm 10.11.0 prints the tarball path and rewrites the Web Component's dependency to "@rendis/statepro-studio-react": "0.2.0".
  • npm publish --dry-run accepts both tarballs.
• The workflow itself can only run after it is merged, because workflow_dispatch needs the file on the default branch. The first real run should be target: npm for 3.4.0, starting with dry_run: true.