ci: deploy lint-commit from published GitHub Releases

.github/workflows/release.yml

@@ -1,55 +1,43 @@
+# Release and recovery: https://github.com/nlibjs/actions#release-procedure
+# npm Trusted Publisher: nlibjs/lint-commit, release.yml, environment: deployment.
+# Stage requires deployment approval when environment protection is enabled.
 name: Release
-
 on:
-  push:
-    branches: [main]
-    paths: [package.json]
+  release:
+    types: [published]
   workflow_dispatch:
     inputs:
       action:
         description: Operation
         type: choice
-        options: [verify, stage, finalize]
+        options: [verify, stage]
         default: verify
         required: true
-      version:
-        description: "Required for finalize only, e.g. 1.2.3"
+      tag:
+        description: "Published Release tag for retry, e.g. v1.2.3"
         type: string
         default: ""
-        required: false
-
 permissions:
   contents: read
-
 concurrency:
-  group: release
+  group: release-${{ github.event.release.tag_name || inputs.tag || github.ref }}
   cancel-in-progress: false
-
 jobs:
   Verify:
-    if: github.event_name == 'workflow_dispatch' && github.event.inputs.action == 'verify'
+    if: github.event_name == 'workflow_dispatch' && inputs.action == 'verify'
     permissions:
       contents: read
-    uses: nlibjs/actions/.github/workflows/npm-release.yml@986b87befafad2f4f990c934165a90ea37ddbf36
+    uses: nlibjs/actions/.github/workflows/npm-release.yml@cde77910e399ec821de29a242f01e44311461605
     with:
       action: verify
-
   Stage:
-    if: github.event_name == 'push' || github.event.inputs.action == 'stage'
+    if: (github.event_name == 'release' && !github.event.release.prerelease) || inputs.action == 'stage'
     permissions:
-      contents: write
+      contents: read
+      actions: read
       id-token: write
-    uses: nlibjs/actions/.github/workflows/npm-release.yml@986b87befafad2f4f990c934165a90ea37ddbf36
+    uses: nlibjs/actions/.github/workflows/npm-release.yml@cde77910e399ec821de29a242f01e44311461605
     with:
       action: stage
+      tag: ${{ github.event.release.tag_name || inputs.tag }}
       environment: deployment
-
-  Finalize:
-    if: github.event_name == 'workflow_dispatch' && github.event.inputs.action == 'finalize'
-    permissions:
-      contents: write
-    uses: nlibjs/actions/.github/workflows/npm-release.yml@986b87befafad2f4f990c934165a90ea37ddbf36
-    with:
-      action: finalize
-      environment: deployment
-      version: ${{ github.event.inputs.version }}

README.md

@@ -31,7 +31,3 @@ Then, set `@nlib/lint-commit` to `commit-msg` hook.
 #!/bin/sh
 npx @nlib/lint-commit --input "$1"
 ```
-
-## Releases
-
-Maintainers can follow the [release guide](docs/releases.md).