[MattCCC]

This pull request turns the npm publishing workflow into a Release job that only repository admins can run. It targets the 4.3.0 release pull request #120, so that 4.3.0 is published with it.

✨ Features & Improvements

• Renamed the "Publish to npm" workflow to "Release", with a single Release job. It still runs when a GitHub release is published, or manually from the Actions tab, and publishes through npm trusted publishing (OIDC) with provenance.
• Admins only: the first step looks up the permission of the user who started the run, or re-ran it, through the GitHub API, and stops unless it's admin. As fetchff is a personal repository, that's only @MattCCC. Collaborators with write access can still publish GitHub releases and run workflows, but the job then fails without publishing anything.
• Least privilege: the token has no permissions by default, and the job only gets contents: read and id-token: write.
• Checks before publishing: for GitHub releases, the tag must match the version in package.json (e.g. v4.3.0 for 4.3.0), and the tests must pass before the package is built and published. Only one release runs at a time.
• npm environment: the job runs in a GitHub environment named npm, which links to the package on npm and can require an approval (see below).
• The file is still publish.yml, as npm's trusted publisher for fetchff is bound to that file name. No token or other setup is needed to release.

🔒 Recommended Settings

The admin check runs from the workflow file of the commit being released, so someone with write access could skip it with a modified copy of the workflow on another branch. These settings, which only admins can change, close that gap:

1. GitHub → Settings → Environments → npm (created by the first run, or added by hand): add @MattCCC as a required reviewer, and limit the deployment branches and tags to master and v*.
2. npm → fetchff → Settings → Trusted Publisher: set the environment name to npm, so that npm only accepts releases from that environment. Under Publishing access, "Require two-factor authentication and disallow tokens" also rules out publishing with tokens.

🧪 Tests

• The admin check was tried with admin, write and failing API responses, and the tag check with matching and mismatching tags.
• actionlint reports no issues.

🏷️ Releasing

Once #120 is merged, publish a GitHub release with the tag v4.3.0 on master. The Release job then publishes 4.3.0 to npm. If the environment requires a reviewer, approve it under "Review deployments" in the run.

---

Generated by Claude Code

[github-actions]

size-limit report 📦

Path	Size
dist/browser/index.mjs	7.95 KB (0%)
dist/browser/index.global.js	8.14 KB (0%)
dist/node/index.js	8.03 KB (0%)
dist/react/index.mjs	11.03 KB (0%)
dist/react/index.js	11.87 KB (0%)

[MattCCC]

We can't let any random person or bot to hit publishing. If anyone is worried of a bus factor, you can always fork it. That's the beauty of OSS 😃