Repository navigation

docs: describe what the package does, not who uses it #2

	name: CI

	on:
	push:
	branches: [main]
	tags: ['v*']
	pull_request:

	permissions:
	contents: read

	jobs:
	test:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: 24
	- run: npm ci
	# The integration tests build real repositories and run the commands
	# against them; they set their own git identity per repository, so the
	# runner needs no global config.
	- run: npm test

	publish:
	needs: test
	if: startsWith(github.ref, 'refs/tags/v')
	runs-on: ubuntu-latest
	permissions:
	contents: read
	# For npm provenance: the published package carries a signed statement
	# linking it to this workflow and commit.
	id-token: write
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: 24
	registry-url: 'https://registry.npmjs.org'
	- run: npm ci
	# The tag is the source of truth for what gets published: publishing a
	# version the tag does not name is how a registry and a repository drift.
	- name: Tag must name the version being published
	run: \|
	VERSION=$(node -p "require('./package.json').version")
	if [ "v$VERSION" != "$GITHUB_REF_NAME" ]; then
	echo "::error::tag $GITHUB_REF_NAME does not match package.json version $VERSION"
	exit 1
	fi
	- run: npm publish --provenance
	env:
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}