Let only admins publish releases to npm

.github/workflows/publish.yml

@@ -1,18 +1,40 @@
-name: Publish to npm
+name: Release
 
+# Keep the file name: npm's trusted publisher for fetchff is bound to publish.yml
 on:
     release:
         types: [published]
     workflow_dispatch:
 
-permissions:
-    contents: read
-    id-token: write # Required for OIDC
+permissions: {}
+
+concurrency:
+    group: release
+    cancel-in-progress: false
 
 jobs:
-    publish:
+    release:
+        name: Release
         runs-on: ubuntu-latest
+        environment:
+            name: npm
+            url: https://www.npmjs.com/package/fetchff
+        permissions:
+            contents: read
+            id-token: write # Required for OIDC
         steps:
+            # github.triggering_actor is the user who started this run, or re-ran it
+            - name: Check that an admin started the release
+              env:
+                  GH_TOKEN: ${{ github.token }}
+                  ACTOR: ${{ github.triggering_actor }}
+              run: |
+                  permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" --jq .permission)
+                  if [ "$permission" != "admin" ]; then
+                      echo "::error::Only admins can publish to npm, and $ACTOR has $permission access."
+                      exit 1
+                  fi
+
             - uses: actions/checkout@v7
 
             - uses: actions/setup-node@v7
@@ -21,9 +43,23 @@ jobs:
                   registry-url: "https://registry.npmjs.org"
                   package-manager-cache: false # Never publish a build made from cached dependencies
 
+            - name: Check that the release tag matches the version
+              if: github.event_name == 'release'
+              env:
+                  TAG: ${{ github.event.release.tag_name }}
+              run: |
+                  version=$(node -p "require('./package.json').version")
+                  if [ "${TAG#v}" != "$version" ]; then
+                      echo "::error::The release tag $TAG does not match version $version in package.json."
+                      exit 1
+                  fi
+
             - name: Install dependencies
               run: npm ci
 
+            - name: Test
+              run: npm test -- --ci --maxWorkers=2
+
             - name: Build
               run: npm run build