ci: fan out build -> [npm, jsr] in parallel

Reshapes the publish workflow into build -> {npm, jsr}:
- 'build' job runs deno task build-npm + ./stage-jsr.sh, uploads
  npm/ and build/ as artifacts.
- 'npm' and 'jsr' jobs both have needs: build and no mutual dependency,
  so Actions runs them concurrently after build completes.

Factor the JSR staging out of publish-jsr.sh into a dedicated
stage-jsr.sh so CI can reuse the exact same tree locally developers
get via ./publish-jsr.sh. The local script now just composes
stage-jsr.sh + 'deno publish'.

JSR OIDC inherits id-token: write from the workflow-level permissions,
so no PAT secret is required after linking the package in JSR settings.

Also gitignore build/ and switch npm publish to the standard
setup-node@v4 + NODE_AUTH_TOKEN flow instead of hand-rolled .npmrc.

Author: jjsaunier

.github/workflows/publish.yaml

@@ -1,66 +1,94 @@
-
 name: Publish to NPM + JSR
 
 on:
   workflow_dispatch:
   push:
     tags:
-      - 'v*' # This will run the workflow when you push a tag with a version format, like v1.0.0
+      - 'v*' # Runs when a version tag is pushed, e.g. v0.10.3
 
 permissions:
   id-token: write
   contents: read
 
 jobs:
   build:
-    name: Publish to NPM
+    name: Build
     runs-on: ubuntu-latest
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install Deno
         uses: denoland/setup-deno@v1
         with:
           deno-version: v1.x
 
-      - name: Run Deno build script
+      # Produces ./npm (dnt-generated Node package).
+      - name: Build npm package
         run: deno task build-npm
 
-      - name: Navigate to npm directory
-        run: cd ./npm
+      # Produces ./build (staged JSR payload: src + deno.json, no tests).
+      - name: Stage JSR package
+        run: ./stage-jsr.sh
+
+      - name: Upload npm artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: npm-package
+          path: npm/
+          retention-days: 1
+
+      - name: Upload jsr artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: jsr-package
+          path: build/
+          retention-days: 1
 
+  npm:
+    name: Publish to NPM
+    runs-on: ubuntu-latest
+    needs: build
+
+    steps:
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Download npm artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: npm-package
+          path: npm
 
       - name: Publish
-        run: |
-          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > .npmrc
-          if grep -qE "_authToken=.{1,}" .npmrc; then
-            npm publish
-          else
-            echo "Failed to create .npmrc file" && exit 1
-          fi
+        run: npm publish
         working-directory: ./npm
         env:
-          NPM_TOKEN: ${{ secrets.NPM_AUTOMATION_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTOMATION_TOKEN }}
 
   jsr:
     name: Publish to JSR
     runs-on: ubuntu-latest
     needs: build
 
     steps:
-      - name: Clone repository
-        uses: actions/checkout@v3
-
       - name: Install Deno
         uses: denoland/setup-deno@v1
         with:
           deno-version: v1.x
 
-      - name: Publish to JSR
-        # publish-jsr.sh stages src + deno.json under ./build, strips
-        # __tests__, then runs `deno publish --allow-dirty`. With
-        # id-token: write set at the workflow level, deno publish
-        # exchanges the OIDC token with JSR — no PAT needed.
-        run: ./publish-jsr.sh
+      - name: Download jsr artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: jsr-package
+          path: build
+
+      # OIDC authenticates via the workflow-level id-token: write. Once the
+      # JSR package is linked to this repo, no token secret is required.
+      - name: Publish
+        run: deno publish --allow-dirty
+        working-directory: ./build

.gitignore

@@ -2,6 +2,7 @@ node_modules
 coverage
 scripts
 npm
+build
 dev
 cov_profile
 .vscode

publish-jsr.sh

@@ -1,23 +1,9 @@
 #!/bin/bash
+# Local-dev wrapper: stage the JSR tree and publish it. CI splits these
+# two steps so the staged tree becomes a build artifact shared with the
+# npm publish job (see .github/workflows/publish.yaml).
 set -euo pipefail
 
-# Clean up any existing build directory
-rm -rf build
-
-# Create a fresh build directory
-mkdir build
-
-# Copy necessary files to the build directory
-cp -R src build/
-cp -R __tests__ build/
-cp deno.json build/
-cp README.md build/
-cp LICENSE build/
-
-# Change to the build directory
+./stage-jsr.sh
 cd build
-
-# Publish the package.
-# __tests__ was copied in above; strip it so JSR doesn't index tests.
-rm -rf __tests__
 deno publish --allow-dirty

stage-jsr.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# Stage a JSR-publishable tree under ./build. Used by both the local
+# publish-jsr.sh wrapper and the CI build job.
+set -euo pipefail
+
+rm -rf build
+mkdir build
+
+cp -R src build/
+cp deno.json build/
+cp README.md build/
+cp LICENSE build/
+
+# __tests__ is intentionally NOT copied — JSR ships src + manifest only.