docs(phase-04): complete phase execution — verified 5/5 must-haves #248

	name: Release

	on:
	push:
	branches: [main]
	workflow_dispatch:

	concurrency:
	group: release
	cancel-in-progress: false

	permissions:
	contents: write
	issues: write
	pull-requests: write
	id-token: write

	jobs:
	build-and-test:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-node@v4
	with:
	node-version: 22

	- run: npm ci

	- name: Build
	run: npm run build
	env:
	STANDALONE_BUILD: 'true'

	- name: Test
	run: npm test

	e2e:
	needs: build-and-test
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-node@v4
	with:
	node-version: 22

	- run: npm ci

	- name: Build
	run: npm run build
	env:
	STANDALONE_BUILD: 'true'

	- name: E2E Tests
	run: npm run e2e

	release:
	needs: [build-and-test, e2e]
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	token: ${{ secrets.GITHUB_TOKEN }}

	- uses: actions/setup-node@v4
	with:
	node-version: 22
	registry-url: https://registry.npmjs.org

	# Run npm ci without auth token — the token is only needed for publish.
	# setup-node writes an .npmrc that injects NODE_AUTH_TOKEN for every request,
	# which causes 403 when npm tries to download the "npm" package itself
	# (@semantic-release/npm bundles npm as a dependency).
	- run: npm ci
	env:
	NODE_AUTH_TOKEN: ""

	- name: Build
	run: npm run build
	env:
	STANDALONE_BUILD: 'true'

	- name: Release
	run: ./node_modules/.bin/semantic-release
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
	HUSKY: '0'

Provide feedback