chore(infra): set up ci and npm deploy

.github/workflows/deploy.yaml

@@ -0,0 +1,57 @@
+name: Release
+on:
+  # manual trigger
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    name: release
+    runs-on:
+      group: npm-deploy
+    environment:
+      name: release
+    permissions:
+      id-token: write
+      contents: write
+    steps:
+      - name: Load secret
+        uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0
+        with:
+          # Export loaded secrets as environment variables
+          export-env: true
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          # You may need to change this to your vault name and secret name
+          # Refer to it by calling env.NPM_TOKEN
+          # This token is also limited by IP to ONLY work on the runner
+          NPM_TOKEN: op://npm-deploy/npm-runner-token/secret
+
+      - name: Checkout
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
+
+      - name: Setup Node
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7
+        with:
+          cache: yarn
+          node-version: 18
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: stable
+
+      - name: Install dependencies
+        run: |
+          yarn install --immutable --immutable-cache
+          git submodule update --init --recursive
+
+      - name: Compile
+        run: forge build
+
+      - name: Release
+        env:
+          NPM_CONFIG_USERCONFIG: /dev/null
+          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc && yarn publish

.github/workflows/semgrep.yml

@@ -7,7 +7,7 @@ on:
       - main
   schedule:
     # random HH:MM to avoid a load spike on GitHub Actions at 00:00
-    - cron: '35 11 * * *'
+    - cron: "35 11 * * *"
 jobs:
   semgrep:
     name: semgrep/ci

.github/workflows/test.yml

@@ -20,7 +20,7 @@ jobs:
         uses: foundry-rs/foundry-toolchain@v1
         with:
           version: stable
-      
+
       - name: Run tests
         run: forge test --isolate -vvv
         env: