ci: publish to npmjs on version tags with trusted publishing

Replaces the Drone pipeline: npmjs is where this package is distributed, and
Verdaccio proxies it. No npm token: the workflow's OIDC identity is the npm
trusted publisher, and npm records provenance for the tag's commit.

.drone.yml

@@ -1,44 +0,0 @@
-# On every push to master: test, then publish @crudy/pgmorbac to Verdaccio,
-# the same way the crudy monorepo publishes its packages. A version the
-# registry already holds is skipped, so a push without a version bump passes.
-# prepack downloads the signed GitHub release of the same version and verifies
-# it, so the release must exist before the version bump is pushed.
-#
-# Host networking reaches the real Verdaccio on 127.0.0.1:4873; the repo must be
-# marked Trusted in Drone.
-#
-# Required Drone secret:
-#   npm_auth   base64 of "<user>:<password>" for Verdaccio (publish rights)
-kind: pipeline
-type: docker
-name: publish
-
-trigger:
-  branch:
-    - master
-  event:
-    - push
-
-network_mode: host
-
-steps:
-  - name: test
-    image: node:24
-    commands:
-      - npm ci --no-audit --no-fund
-      - npm test
-
-  - name: npm-publish
-    image: node:24
-    environment:
-      NPM_AUTH:
-        from_secret: npm_auth
-    commands:
-      - echo "//localhost:4873/:_auth=$NPM_AUTH" > ~/.npmrc
-      - VERSION=$(node -p "require('./package.json').version")
-      - |
-        if npm view "@crudy/pgmorbac@$VERSION" version --registry http://localhost:4873 >/dev/null 2>&1; then
-          echo "@crudy/pgmorbac@$VERSION already published"
-        else
-          npm publish --registry http://localhost:4873
-        fi

.github/workflows/publish.yml

@@ -0,0 +1,51 @@
+# Publishes @crudy/pgmorbac to npmjs on version tags (v<major>.<minor>.<patch>)
+# through npm trusted publishing: GitHub's OIDC token stands in for an npm
+# token, and npm attaches a provenance statement naming this repository and
+# commit. The organisation only allows its own actions, so checkout and Node
+# setup are plain shell. prepack downloads the signed crudylabs/pgmorbac
+# release of the same version and verifies it, so that release must exist
+# before this tag is pushed.
+name: publish
+
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    env:
+      NODE_VERSION: v24.12.0
+    steps:
+      - name: Check out the tag
+        run: |
+          case "$GITHUB_REF_NAME" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "not a version tag: $GITHUB_REF_NAME" >&2; exit 1 ;; esac
+          git init -q .
+          git fetch -q --depth 1 "https://github.com/$GITHUB_REPOSITORY" "refs/tags/$GITHUB_REF_NAME:refs/tags/$GITHUB_REF_NAME"
+          git checkout -q "refs/tags/$GITHUB_REF_NAME"
+      - name: Install Node
+        run: |
+          base="https://nodejs.org/dist/$NODE_VERSION"
+          file="node-$NODE_VERSION-linux-x64.tar.xz"
+          curl -fsSLO "$base/$file"
+          curl -fsSL "$base/SHASUMS256.txt" | grep " $file\$" | sha256sum -c -
+          mkdir -p "$RUNNER_TEMP/node"
+          tar -xJf "$file" -C "$RUNNER_TEMP/node" --strip-components=1
+          rm "$file"
+          echo "$RUNNER_TEMP/node/bin" >> "$GITHUB_PATH"
+      - run: npm ci --no-audit --no-fund
+      - run: npm test
+      - name: Publish
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          [ "v$VERSION" = "$GITHUB_REF_NAME" ] || { echo "tag $GITHUB_REF_NAME does not match package version $VERSION" >&2; exit 1; }
+          NAME=$(node -p "require('./package.json').name")
+          if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
+            echo "$NAME@$VERSION is already published"
+          else
+            npm publish --access public
+          fi