feat: add version management and migration support #9

	name: Release

	on:
	push:
	branches:
	- main

	permissions:
	contents: write
	id-token: write # Required for OIDC Trusted Publishing

	concurrency:
	cancel-in-progress: true
	group: ${{ github.workflow }}

	jobs:
	release:
	runs-on: ubuntu-latest
	steps:
	# SHA-pinned actions (prevent tag hijacking)
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	fetch-depth: 0

	- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0

	- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
	with:
	node-version: '24'
	registry-url: 'https://registry.npmjs.org'
	cache: 'pnpm'

	# Install with --ignore-scripts (prevent malicious postinstall)
	- run: pnpm install --frozen-lockfile --ignore-scripts

	- run: git config user.name "${{ github.actor }}"
	- run: git config user.email "${{ github.actor }}@users.noreply.github.com"

	# Release with OIDC (NO NPM_TOKEN needed)
	# ⚠️ Do NOT set NODE_AUTH_TOKEN - OIDC handles auth automatically
	- env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	# Check if the latest commit message contains a release tag pattern (e.g., "release v1.2.3")
	# If found, execute release-it without version increment since version was already bumped in the commit
	run: \|
	if git log --format=%B -n 1 \| grep -E -q 'release v[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'; then
	pnpm release-it --no-increment --verbose
	fi

Provide feedback