feat(release)!: replace release workflow with publish action

.github/workflows/__main-ci.yml

@@ -34,7 +34,7 @@ jobs:
   release:
     needs: ci
     if: github.event_name != 'schedule'
-    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@1ee0354c40e4cd0a46c69cbe305c74fc67338042 # 0.28.0
+    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@a0a9d185c51c10710a5987822e78feb2b5ce1932 # 0.29.0
     permissions:
       contents: read
     with:

.github/workflows/__shared-ci.yml

@@ -56,6 +56,14 @@ jobs:
     permissions:
       contents: read
 
+  test-action-publish:
+    name: Test action "publish"
+    needs: linter
+    uses: ./.github/workflows/__test-action-publish.yml
+    permissions:
+      actions: read
+      contents: read
+
   test-workflow-continuous-integration:
     name: Test workflow "continuous-integration"
     needs: linter
@@ -67,12 +75,3 @@ jobs:
       id-token: write
       issues: read
       security-events: write
-
-  test-workflow-release:
-    name: Test workflow "release"
-    needs: linter
-    uses: ./.github/workflows/__test-workflow-release.yml
-    permissions:
-      contents: read
-      packages: write
-      id-token: write

.github/workflows/__test-action-publish.yml

@@ -0,0 +1,83 @@
+name: Internal - Tests for "publish" action
+
+on:
+  workflow_call:
+
+permissions: {}
+
+jobs:
+  package:
+    name: Arrange package tarball
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      package-tarball-artifact-id: ${{ steps.package.outputs.package-tarball-artifact-id }}
+    steps:
+      - name: Arrange - Checkout sources
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - id: package
+        name: Arrange - Create package tarball
+        uses: ./actions/package
+        with:
+          working-directory: tests/npm
+
+  publish:
+    name: Publish dry run (${{ matrix.os }}, ${{ matrix.tag || 'default tag' }})
+    needs: package
+    runs-on: ${{ matrix.os }}
+    permissions:
+      actions: read
+      contents: read
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        tag: ["", next]
+    steps:
+      - name: Arrange - Checkout sources
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Act - Run "publish" action
+        uses: ./actions/publish
+        with:
+          package-tarball-artifact-id: ${{ needs.package.outputs.package-tarball-artifact-id }}
+          tag: ${{ matrix.tag }}
+          access: ${{ matrix.tag == 'next' && 'restricted' || 'public' }}
+          dry-run: "true"
+          provenance: "false"
+
+      - id: invalid-artifact
+        name: Act - Reject multiple artifact IDs
+        continue-on-error: true
+        uses: ./actions/publish
+        with:
+          package-tarball-artifact-id: "1,2"
+          dry-run: "true"
+          provenance: "false"
+
+      - id: invalid-dry-run
+        name: Act - Reject invalid dry-run input
+        continue-on-error: true
+        uses: ./actions/publish
+        with:
+          package-tarball-artifact-id: ${{ needs.package.outputs.package-tarball-artifact-id }}
+          dry-run: "yes"
+          provenance: "false"
+
+      - name: Assert - Invalid inputs fail before publishing
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          INVALID_ARTIFACT_OUTCOME: ${{ steps.invalid-artifact.outcome }}
+          INVALID_DRY_RUN_OUTCOME: ${{ steps.invalid-dry-run.outcome }}
+        with:
+          script: |
+            for (const outcome of [process.env.INVALID_ARTIFACT_OUTCOME, process.env.INVALID_DRY_RUN_OUTCOME]) {
+              if (outcome !== 'failure') {
+                core.setFailed('Expected invalid publish inputs to fail');
+              }
+            }