ci: automate versioning and npm publishing via nx release

[BioPhoton]

Automates versioning and npm publishing, modelled on push-based/zod2nx-schema.

⚠️ Do not merge yet

Merging triggers a real release. The npm trusted publisher is not configured yet (Plan 1 §C2), so today the result would be: release.yml succeeds (version, changelog, tag v1.0.5, GitHub Release) and then publish.yml fails on npm auth — leaving a tag and release with nothing published. Recoverable by re-running the job afterwards, no re-tag needed, but better avoided.

Merge once npm login confirms package ownership and the trusted publisher is set to push-based / cpu-prof / publish.yml / release.

How it works

push to main
   └─> release.yml    (as pushbased-bot[bot])
         nx release --skip-publish  ->  version, changelog, commit, tag v{version}, GitHub Release
                 └─> tag push v*.*.*
                       └─> publish.yml   (OIDC, environment: release)
                             nx release publish  ->  registry.npmjs.org

Two workflows joined by a tag: publishing is triggered by an immutable ref, so a failed publish is retried by re-running one job rather than re-versioning. No NPM_TOKEN — npm trusted publishing over OIDC.

Changes

• .node-version pinned to 24.19.0; ci.yml reads it instead of hardcoding Node 20
• nx.json: release config (independent versioning scoped to cpu-prof, v{version} tags, project changelogs + GitHub releases) and an nx-release-publish target default
• packages/cpu-prof/package.json: publishConfig.access, repository, license, description, keywords
• docs/publishing/: the credential plan and the implementation plan

Three deliberate deviations from the reference repo

1. packageRoot: "{projectRoot}", not "{projectRoot}/dist". zod2nx builds with @nx/js:tsc and publishes dist/ as the package root; cpu-prof builds with rollup and its main is relative to the project root, with files: ["dist"] filtering. Copying the reference verbatim would ship entry points resolving to dist/dist/….
2. independent versioning, scoped to cpu-prof. fixed across packages/* would drag nx-perf (0.0.1, never published) to 1.0.5.
3. createRelease on projectChangelogs, not workspaceChangelog. The reference's placement is silently incompatible with independent — Nx disables the workspace changelog and the GitHub Release with it. The first dry run hit exactly this.

Also: Node 24 is required, not cosmetic — OIDC publishing needs npm ≥ 11.5.1, and Node 20 ships npm 10.x. Watch the patch level when bumping; Node 24.1.0 ships npm 11.3.0, still below the threshold.

Verification (local dry runs, nothing written)

• nx release --dry-run → 1.0.5, tag v1.0.5, GitHub Release previewed
• nx release publish --dry-run → correct target, registry registry.npmjs.org, correctly refuses (v1.0.4 already published)
• npm pack --dry-run → 103 files / 34.6 kB; no src/, mocks/ or *.tsbuildinfo
• all three workflow YAMLs parse; nx format:check clean

Expect a patch bump: Nx scopes conventional-commit analysis to commits touching the released project, and only the fix(lint) commit touches packages/cpu-prof.

Pre-existing defect worth deciding on separately

package.json declares "main": "./dist/index.cjs" and a require condition, but the build emits ESM only — no index.cjs exists, so require('@push-based/cpu-prof') fails. Not introduced here: the live 1.0.4 tarball has the same gap. Automation means shipping it every release, so either drop the CJS claims (the package is already "type": "module") or configure rollup for dual output. Left out of scope as a package-API call; documented in docs/publishing/02-implementation.md.