npm publishing via ci and trusted publisher

Author: gms1

.github/workflows/ci.yml

@@ -13,6 +13,33 @@ concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 jobs:
+  verify-version:
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Verify tag version matches package.json
+        run: |
+          # Extract tag name from GITHUB_REF (e.g., refs/tags/v6.0.2 -> v6.0.2)
+          TAG_NAME="${GITHUB_REF#refs/tags/}"
+          # Remove 'v' prefix if present to get the version number
+          TAG_VERSION="${TAG_NAME#v}"
+
+          # Get version from package.json
+          PACKAGE_VERSION=$(node -p "require('./package.json').version")
+
+          echo "Tag version: $TAG_VERSION"
+          echo "Package version: $PACKAGE_VERSION"
+
+          if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then
+            echo "ERROR: Tag version ($TAG_VERSION) does not match package.json version ($PACKAGE_VERSION)"
+            echo "Please update package.json or create a new tag with the correct version"
+            echo "GitHub release will NOT be created."
+            exit 1
+          fi
+
+          echo "Version match verified!"
+
   build:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -163,3 +190,23 @@ jobs:
       - name: Upload binaries to GitHub Release
         run: yarn install --ignore-scripts && yarn upload --upload-all ${{ github.token }}
         if: startsWith(github.ref, 'refs/tags/')
+
+  publish-npm:
+    needs: [build, build-musl]
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: yarn install --ignore-scripts
+
+      - name: Publish to npm
+        run: npm publish

docs/DEVELOP.md

@@ -0,0 +1,52 @@
+# Development and Release Guide
+
+## Version Bumping
+
+This project uses [npm version](https://docs.npmjs.com/cli/v10/commands/npm-version) to manage version releases.
+
+### How to release a new version
+
+1. **Bump the version** (this will create a Git tag automatically):
+   ```bash
+   npm version <major|minor|patch>
+   ```
+
+   For example:
+   ```bash
+   npm version patch
+   ```
+
+2. **Push the changes and tags**:
+   ```bash
+   git push origin main --tags
+   ```
+
+   The CI workflow will automatically:
+   - Build binaries for all platforms
+   - Upload them as release assets
+   - Publish the package to npm
+
+### Version format
+
+- Versions follow [SemVer](https://semver.org/) format
+- Tags should be prefixed with `v`, e.g., `v6.0.2`
+- The version in `package.json` must match the Git tag version
+
+## Release process
+
+When you push a tag (e.g., `v6.0.2`), the CI workflow will:
+
+1. Build prebuilt binaries for:
+   - macOS (x64, arm64)
+   - Linux (x64, arm64)
+   - Windows (x64, ia32)
+
+2. Upload binaries to GitHub Release
+
+3. Publish to npm using trusted publishing (no NPM_TOKEN required)
+
+## Checking the release
+
+After releasing, you can verify:
+- GitHub Release with binaries: https://github.com/gms1/node-sqlite3/releases
+- npm package: https://www.npmjs.com/package/@homeofthings/sqlite3

package.json

@@ -76,6 +76,9 @@
     "test": "node test/support/createdb.js && mocha -R spec --timeout 480000"
   },
   "license": "BSD-3-Clause",
+  "publishConfig": {
+    "access": "public"
+  },
   "keywords": [
     "sql",
     "sqlite",