#242 update github actions

[ienaga]

No description provided.

[Copilot]

Pull request overview

Updates the npm publish GitHub Actions workflow, seemingly to support a more automated package publish process (and possibly OIDC/trusted publishing) for the repository’s dist outputs.

Changes:

• Added workflow-level GitHub Actions permissions (id-token: write, contents: read).
• Replaced the explicit per-package npm publish --access public steps with a loop that finds package.json files under ./dist and publishes via npm publish --workspace=....

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The workflow-level permissions block grants id-token: write, but this job also defines its own permissions (lines 15-17) which overrides the workflow defaults. As written, the build job will NOT receive id-token: write, so any OIDC/trusted-publishing flow will fail. Consider either adding id-token: write to the job permissions, or removing the job-level permissions block if it’s not needed.

[Copilot]

npm publish --workspace="${dir}" is likely incorrect here: the directories under ./dist are not declared as npm workspaces (root package.json only includes packages/*), so this may fail with “no matching workspace” or publish the wrong thing. Also, the previous workflow used --access public and an auth token; this new step doesn’t pass --access public (needed for scoped public packages) or any explicit auth mechanism unless you’re relying on npm trusted publishing (which would also require the correct id-token permission and usually --provenance). Recommend publishing by running npm publish with the needed flags from within each dist/... directory, and ensuring authentication/provenance is configured intentionally.

Suggested change

	npm publish --workspace="${dir}"
	(cd "$dir" && npm publish --provenance --access public)