ci: tag-triggered npm release workflow for code and pm

[danii1]

Summary

Adds .github/workflows/npm-release.yml, publishing @getdevintern/code and @getdevintern/pm to npm, modeled on pm-desktop-release.yml.

How to release:

git tag code-v2.4.1 && git push origin code-v2.4.1   # publishes @getdevintern/code
git tag pm-v2.4.1 && git push origin pm-v2.4.1       # publishes @getdevintern/pm

Or run manually via workflow_dispatch (choose code, pm, or both).

Behavior:

• Matrix job per package; a tag push publishes only the tagged package
• Guard step fails the release when the tag doesn't match the package's package.json version
• Builds + typechecks with Bun (bun install --frozen-lockfile → bun run build → typecheck → bun publish --access public)
• Creates a GitHub release with generated notes for tag pushes

Secrets/variables used (already configured unless noted):

Name	Type	Purpose
NPM_TOKEN	secret (add)	npm automation token with publish rights to both scopes
POSTHOG_API_KEY	secret (exists)	Baked into the @getdevintern/code bundle at build time
POSTHOG_HOST	variable/secret (optional)	PostHog ingest host, defaults to https://us.i.posthog.com

Note: POSTHOG_API_KEY/POSTHOG_HOST are set at job level so that any rebuild triggered by prepublishOnly during bun publish still bakes the key into dist/index.js (verified locally: bun publish --dry-run re-runs the build).

Test plan

• YAML parses cleanly
• bun publish --dry-run verified for both packages from this repo layout (correct files packed: dist/index.js + dashboard UI assets for code, dist/lib/prompts for pm)
• After merge: add the NPM_TOKEN secret, then do a dry release (workflow_dispatch) before cutting a real tag

[danii1]

Switched publishing to npm Trusted Publishing (OIDC) per npm's recommendation — no NPM_TOKEN secret needed anymore.

One-time setup per package on npmjs.com (@getdevintern/code and @getdevintern/pm → Settings → Trusted Publisher → GitHub Actions):

• Organization/Repository: getdevintern/devintern
• Workflow filename: npm-release.yml
• Environment: leave empty

Bootstrap caveat: OIDC can't publish a package that doesn't exist yet — if either package has never been published, do the very first publish manually (bun publish from the package dir), then configure the trusted publisher above.

Implementation notes:

• Job gets id-token: write; publish runs via the official npm CLI (npm install -g npm@latest && npm publish) since bun publish doesn't perform the OIDC exchange yet
• Provenance attestations are attached automatically
• Build/typecheck stay on Bun

[danii1]

The failing runs (example) were a workflow-file parse error: I had used ${{ matrix.* }} in the job-level if, but the matrix context isn't available there (only github, inputs, needs, vars), so GitHub rejected the whole file and no jobs ever started — that's why those runs show up named .github/workflows/npm-release.yml with zero jobs.

Fixed by replacing the matrix with two explicit jobs (release-code / release-pm), each with its own simple condition. Also switched the dispatch input to two booleans (code / pm) so manual selection stays obvious. Validated locally with actionlint; CI on this PR now exercises the fixed file.