ci: publish releases to npm, add CodeQL and OpenSSF Scorecard

.github/workflows/codeql.yml

@@ -0,0 +1,34 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "41 4 * * 3"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (javascript-typescript)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+          build-mode: none
+
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:javascript-typescript

.github/workflows/publish.yml

@@ -0,0 +1,79 @@
+name: Publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Pack and run every check without publishing
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+
+      - name: Check that the tag matches package.json
+        env:
+          TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || github.ref_name }}
+          REF_TYPE: ${{ github.event_name == 'release' && 'tag' || github.ref_type }}
+          DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          echo "package.json version: $version, ref: $TAG ($REF_TYPE)"
+          if [ "$TAG" = "v$version" ]; then
+            exit 0
+          fi
+          if [ "$DRY_RUN" = "true" ] && [ "$REF_TYPE" != "tag" ]; then
+            echo "::warning::Dry run from $TAG, not from a release tag; skipping the tag check."
+            exit 0
+          fi
+          echo "::error::Tag $TAG does not match package.json version $version (expected v$version)."
+          exit 1
+
+      - name: Build
+        run: node build.js
+      - name: Check that the committed build is up to date
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "::error::Build output differs from the committed files. Run 'node build.js' and commit the result."
+            git status --porcelain
+            git --no-pager diff --stat
+            exit 1
+          fi
+      - name: List the packed files
+        run: npm pack --dry-run
+
+      - name: Publish
+        env:
+          DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          args=(--provenance --access public)
+          case "$version" in
+            *-*) args+=(--tag next) ;;
+          esac
+          if [ "$DRY_RUN" = "true" ]; then
+            args+=(--dry-run)
+          fi
+          npm publish "${args[@]}"

.github/workflows/scorecard.yml

@@ -0,0 +1,39 @@
+name: Scorecard
+
+on:
+  branch_protection_rule:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "51 5 * * 6"
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: results.sarif

CONTRIBUTING.md

@@ -173,6 +173,27 @@ Open the PR against `main` and fill in the template. A good PR:
 Version bumps and releases are done by the maintainer, so please don't change
 the version in `package.json`.
 
+## Releasing
+
+Releases are published to npm by GitHub Actions, not from a local machine.
+
+1. Bump `version` in `package.json`, run `node build.js` so the new version
+   is stamped into every artifact, move the `## [Unreleased]` entries in
+   `CHANGELOG.md` under the new version, and merge that to `main`.
+2. Create a GitHub release from `main` whose tag is `v` followed by the
+   version, for example `v1.2.0` for `1.2.0`:
+   `gh release create v1.2.0 --target main --title v1.2.0 --notes-file notes.md`.
+3. Publishing the release starts the [Publish
+   workflow](.github/workflows/publish.yml). It first checks that the tag
+   equals `v` + the `package.json` version and stops without publishing if
+   they differ. Then it rebuilds, fails if the committed build output is out
+   of date, and lists the packed files, and finally runs `npm publish
+   --provenance`. Versions with a pre-release suffix (`1.2.0-beta.1`) go to
+   the `next` dist-tag.
+
+To try the workflow without publishing, open **Actions → Publish → Run
+workflow** and leave **dry run** ticked.
+
 ## Reporting bugs and asking for features
 
 Use the issue forms: pick **Bug report** or **Feature request** and fill in the

README.md

@@ -13,6 +13,7 @@ A zero‑dependency CSS **+** JS component framework — fully themeable, light
 [![CI](https://img.shields.io/github/actions/workflow/status/fadyehabamer/NYX/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/fadyehabamer/NYX/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/nyx-css?style=flat-square&color=6c63ff&label=npm)](https://www.npmjs.com/package/nyx-css)
 [![license](https://img.shields.io/npm/l/nyx-css?style=flat-square&color=00d4aa)](LICENSE)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/fadyehabamer/NYX/badge)](https://scorecard.dev/viewer/?uri=github.com/fadyehabamer/NYX)
 ![zero deps](https://img.shields.io/badge/dependencies-0-6c63ff?style=flat-square)
 ![css gzip](https://img.shields.io/badge/CSS-24kb%20gzip-00d4aa?style=flat-square)
 ![js gzip](https://img.shields.io/badge/JS-22kb%20gzip-00d4aa?style=flat-square)