ci: unify publish workflow and npm trusted publishing

.github/workflows/publish.yml

@@ -4,17 +4,25 @@ on:
   push:
     tags:
       - 'v*'
+    branches:
+      - develop
+
+permissions:
+  id-token: write # OIDC for npm trusted publishing
+  contents: write # draft / pre-releases via gh
 
 jobs:
-  publish:
+  publish-release:
+    name: Release (tag)
+    if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      
+      - uses: actions/checkout@v6
+
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '24'
           registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
           cache-dependency-path: nodejs/package-lock.json
@@ -30,20 +38,84 @@ jobs:
       - name: Publish to NPM
         working-directory: nodejs
         run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Extract version from tag
         run: |
-          # Extract version from tag (remove 'v' prefix)
           VERSION=${GITHUB_REF#refs/tags/v}
           echo "VERSION=$VERSION" >> $GITHUB_ENV
           echo "Extracted version: $VERSION"
 
       - name: Create draft release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           gh release create "$GITHUB_REF_NAME" \
-            --title "Release v${{ env.VERSION }}" \
-            --draft
+            --title "Release v${VERSION}" \
+            --draft
+
+  publish-prerelease:
+    name: Pre-release (develop)
+    if: github.ref == 'refs/heads/develop'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+          cache: 'npm'
+          cache-dependency-path: nodejs/package-lock.json
+
+      - name: Install dependencies
+        working-directory: nodejs
+        run: npm ci
+
+      - name: Configure Git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Generate pre-release version
+        working-directory: nodejs
+        run: |
+          CURRENT_VERSION=$(node -p "require('./package.json').version")
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          TIMESTAMP=$(date +%Y%m%d%H%M%S)
+          PRE_RELEASE_VERSION="${CURRENT_VERSION}-beta.${TIMESTAMP}.${SHORT_SHA}"
+          echo "Pre-release version: $PRE_RELEASE_VERSION"
+          echo "PRE_RELEASE_VERSION=$PRE_RELEASE_VERSION" >> $GITHUB_ENV
+          npm version $PRE_RELEASE_VERSION --no-git-tag-version
+
+      - name: Build
+        working-directory: nodejs
+        run: npm run build
+
+      - name: Publish pre-release to NPM
+        working-directory: nodejs
+        run: npm publish --tag beta --access public
+
+      - name: Create GitHub pre-release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "v${PRE_RELEASE_VERSION}" \
+            --title "Pre-release v${PRE_RELEASE_VERSION}" \
+            --notes "🚀 **Pre-release from develop branch**
+
+          This is an automated pre-release build from the develop branch.
+
+          **Changes:**
+          - Commit: ${{ github.sha }}
+          - Branch: ${{ github.ref_name }}
+
+          **Installation:**
+          \`\`\`bash
+          npm install @hackmd/api@beta
+          \`\`\`
+
+          **Note:** This is a pre-release version and may contain unstable features." \
+            --prerelease