workflow: set up automated publishing with provenance support

.github/MAINTENANCE.md

@@ -0,0 +1,11 @@
+This document explains how to perform the project's maintenance tasks.
+
+### Creating a new release
+
+Anyone with write access to the main branch of both this repository and [create-vue-templates](https://github.com/vuejs/create-vue-templates/) can request a new release. This includes repository maintainers, repository adminstrators, and Vue.js organization administrators.
+
+To do so, follow these steps:
+
+1. Run `pnpm version <patch|minor|major>` locally to bump the version number and create a new commit / tag. The `postversion` script will automatically push the changes to the repository.
+2. The release will be automatically published to npm by GitHub Actions once approved by an *administrator*.
+3. Go to <https://github.com/vuejs/create-vue/releases/new> and create a new release with the tag that was just created. Describe the notable changes in the release notes.

.github/workflows/publish.yml

@@ -0,0 +1,28 @@
+name: Publish
+
+on:
+  push:
+    tags:
+      - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
+
+jobs:
+  release:
+    # Use Publish environment for deployment protection
+    environment: Publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 'lts/*'
+          registry-url: 'https://registry.npmjs.org'
+      - run: pnpm install
+      - run: pnpm publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package.json

@@ -23,7 +23,8 @@
     "pretest": "pnpm run build && pnpm run snapshot",
     "test": "zx ./scripts/test.mjs",
     "test:unit": "vitest",
-    "prepublishOnly": "zx ./scripts/prepublish.mjs"
+    "postversion": "zx ./scripts/postversion.mjs",
+    "prepublishOnly": "pnpm run build"
   },
   "repository": {
     "type": "git",
@@ -58,5 +59,9 @@
     "*.{js,ts,vue,json}": [
       "prettier --write"
     ]
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
   }
 }