1name: Publish to JSR23on:4 push:5 tags:6 - "v[0-9]+.[0-9]+.[0-9]+"78jobs:9 publish:10 runs-on: ubuntu-latest11 permissions:12 contents: read13 id-token: write # required for JSR OIDC auth + provenance14 steps:15 - uses: actions/checkout@v616 - uses: denoland/setup-deno@v217 with:18 deno-version: v2.x19 # Publishes the whole workspace (@nzip/shared then @nzip/cli) at the20 # versions in their deno.json. No token needed — OIDC handles auth and21 # attaches build provenance.22 - name: Publish workspace23 run: deno publish