chore: add npm publish workflow and release script (#499)

* chore: add npm publish workflow and release script

- GitHub Actions workflow publishes all packages to npm on `v*` tag push (requires NPM_TOKEN secret)
- scripts/release.sh bumps versions across all packages, commits, and creates the tag

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: use npm OIDC Trusted Publisher instead of token

No NPM_TOKEN secret needed — npm verifies trust via OIDC.
Uses npm publish directly (Yarn 4 doesn't support OIDC) with --provenance.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: address release script issues from Copilot review

- Also bump gl-react pin in devDependencies (where it actually lives)
- Guard against uncommitted changes before mutating package.json files
- Quote dirname path to handle spaces in repo path

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: greweb <greweb@protonmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 3 people

.github/workflows/publish.yml

@@ -0,0 +1,29 @@
+name: Publish to npm
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: corepack enable
+      - run: yarn install
+      - run: yarn build
+
+      - name: Publish packages
+        run: |
+          for pkg in gl-react gl-react-dom gl-react-expo gl-react-headless gl-react-native; do
+            cd packages/$pkg && npm publish --provenance && cd ../..
+          done

scripts/release.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+set -e
+
+VERSION=$1
+if [ -z "$VERSION" ]; then
+  echo "Usage: $0 <version>"
+  echo "Example: $0 5.3.0"
+  exit 1
+fi
+
+cd "$(dirname "$0")/.."
+
+if ! git diff --quiet || ! git diff --cached --quiet; then
+  echo "Error: working tree has uncommitted changes. Please commit or stash them first."
+  exit 1
+fi
+
+PACKAGES="packages/gl-react packages/gl-react-dom packages/gl-react-expo packages/gl-react-headless packages/gl-react-native"
+
+for pkg in $PACKAGES; do
+  node -e "
+    const fs = require('fs');
+    const p = '$pkg/package.json';
+    const d = JSON.parse(fs.readFileSync(p, 'utf8'));
+    d.version = '$VERSION';
+    ['dependencies', 'devDependencies'].forEach(section => {
+      if (d[section]) {
+        if (d[section]['gl-react']) d[section]['gl-react'] = '^$VERSION';
+        if (d[section]['gl-react-expo']) d[section]['gl-react-expo'] = '^$VERSION';
+      }
+    });
+    fs.writeFileSync(p, JSON.stringify(d, null, 2) + '\n');
+  "
+  echo "Bumped $pkg to $VERSION"
+done
+
+git add packages/gl-react/package.json packages/gl-react-dom/package.json packages/gl-react-expo/package.json packages/gl-react-headless/package.json packages/gl-react-native/package.json
+git commit -m "chore: release $VERSION"
+git tag "v$VERSION"
+
+echo ""
+echo "Done. Now push to trigger the publish workflow:"
+echo "  git push && git push --tags"