Add npm provenance publish workflow

[jozefizso]

Summary

• add a release-triggered workflow that publishes @appdmg/appdmg and @appdmg/cli
• require macOS integration tests before publishing
• pack and attest both npm tarballs, then publish those exact artifacts with provenance enabled
• document npm Trusted Publisher settings and release order

Verification

• ruby YAML parse for publish workflow
• npm test
• npm test --prefix packages/cli
• npm audit --audit-level=moderate
• npm audit --audit-level=moderate --prefix packages/cli
• npm ls --omit=dev --all
• npm ls --omit=dev --all --prefix packages/cli
• npm pack --dry-run
• npm pack --dry-run --prefix packages/cli
• npm run test:integration

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b95eab104e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restrict publish trigger to non-prerelease releases

Using release.types: [published] will also fire for GitHub prereleases, so this workflow can run npm publish for prerelease tags. Because npm publish here does not set a non-latest dist-tag, a prerelease run can unintentionally promote prerelease packages to normal consumers. Add a guard (for example, checking github.event.release.prerelease == false) or explicit prerelease tagging logic.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Make package publish steps rerun-safe

The workflow publishes @appdmg/appdmg and then @appdmg/cli in one linear job without checking whether a version is already on npm. If the first publish succeeds but the second fails (for example due to a transient npm outage), rerunning this workflow for the same release will fail on the first npm publish with “version already exists,” blocking recovery for the CLI package without creating a new release/version.

Useful? React with 👍 / 👎.