ci: add Forgejo publish workflow

.forgejo/workflows/publish.yml

@@ -0,0 +1,85 @@
+name: Build and Publish
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+env:
+  NODE_VERSION: '22'
+  PNPM_VERSION: '9'
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    env:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Setup pnpm
+        run: |
+          npm install -g pnpm@${{ env.PNPM_VERSION }}
+          echo "Node: $(node --version)"
+          echo "pnpm: $(pnpm --version)"
+
+      - name: Configure npm registry
+        run: |
+          echo "@lilith:registry=https://forge.nasty.sh/api/packages/lilith/npm/" > .npmrc
+          echo "//forge.nasty.sh/api/packages/lilith/npm/:_authToken=\${NPM_TOKEN}" >> .npmrc
+          echo "strict-ssl=false" >> .npmrc
+
+      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Build
+        run: |
+          if grep -q "build" package.json; then
+            pnpm run build || echo "Build had warnings"
+          fi
+
+      - name: Publish
+        run: |
+          PKG_NAME=$(node -p "require('./package.json').name")
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          SHOULD_PUBLISH=$(node -p "require('./package.json')?._?.publish === true")
+          REGISTRY=$(node -p "require('./package.json')?._?.registry || 'none'")
+          
+          if [ "$REGISTRY" \!= "forgejo" ]; then
+            echo "Skipping: registry is not forgejo"
+            exit 0
+          fi
+          
+          if [ "$SHOULD_PUBLISH" \!= "true" ]; then
+            echo "Skipping: publish not enabled"
+            exit 0
+          fi
+          
+          if npm view "$PKG_NAME@$PKG_VERSION" version 2>/dev/null; then
+            echo "Already published: $PKG_NAME@$PKG_VERSION"
+          else
+            echo "Publishing $PKG_NAME@$PKG_VERSION..."
+            node -e "
+              const fs = require('fs');
+              const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+              const transform = (deps) => {
+                if (\!deps) return deps;
+                for (const [n, v] of Object.entries(deps)) {
+                  if (v.startsWith('workspace:') || v.startsWith('file:')) deps[n] = '*';
+                }
+                return deps;
+              };
+              pkg.dependencies = transform(pkg.dependencies);
+              pkg.devDependencies = transform(pkg.devDependencies);
+              pkg.peerDependencies = transform(pkg.peerDependencies);
+              fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2));
+            "
+            npm publish --access public --no-git-checks
+          fi
+