ci: changesets and GitHub Actions release pipeline

.changeset/bun-migration.md

@@ -0,0 +1,8 @@
+---
+"@expressive/sqlite": minor
+"@expressive/sql": patch
+"@expressive/postgres": patch
+"@expressive/orm": patch
+---
+
+Pluggable SQLite driver with runtime fallback (bun:sqlite → node:sqlite → better-sqlite3 → sqlite3 → @libsql/client); better-sqlite3 is now an optional dependency. Packages are now ESM-only, built with tsdown. Fixes circular-dependency initialization and type-only export issues surfaced by per-module ESM evaluation.

.changeset/changelog-no-thanks.cjs

@@ -0,0 +1,9 @@
+const github = require('@changesets/changelog-github').default;
+
+module.exports = {
+  getDependencyReleaseLine: github.getDependencyReleaseLine,
+  async getReleaseLine(changeset, type, options) {
+    const line = await github.getReleaseLine(changeset, type, options);
+    return line.replace(/Thanks \[@[^\]]+\]\([^)]+\)! ?- /, '');
+  },
+};

.changeset/config.json

@@ -1,10 +1,10 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3.0.5/schema.json",
-  "changelog": "@changesets/cli/changelog",
+  "$schema": "https://unpkg.com/@changesets/config@3.1.4/schema.json",
+  "changelog": ["./changelog-no-thanks.cjs", { "repo": "gabeklein/expressive-orm" }],
   "commit": false,
   "fixed": [],
   "linked": [],
-  "access": "restricted",
+  "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
   "ignore": []

.github/actions/setup/action.yml

@@ -0,0 +1,19 @@
+name: Setup
+description: Install bun and dependencies
+
+runs:
+  using: composite
+  steps:
+    - name: Setup bun
+      uses: oven-sh/setup-bun@v2
+
+    - name: Cache dependencies
+      uses: actions/cache@v5
+      with:
+        path: ~/.bun/install/cache
+        key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+        restore-keys: bun-${{ runner.os }}-
+
+    - name: Install dependencies
+      run: bun install --frozen-lockfile
+      shell: bash

.github/workflows/README.md

@@ -0,0 +1,27 @@
+# CI/CD Workflow Overview
+
+## pr.yml (pull requests -> main)
+
+Blocking: `bun run test` and `bun run build`. The frozen-lockfile install in
+the `setup` action doubles as the internal-dependency desync guard - a
+workspace version that falls outside a sibling's range cannot reach main.
+
+Non-blocking signals: `changeset status` (a preview of which packages would
+bump) and `npm publish --dry-run` pack validation for the publishable packages.
+
+## release.yml (push -> main)
+
+`changesets/action` maintains the "Version Packages" PR (`changeset version`
++ `bun install` so the lockfile stays consistent with the bumps). Merging that
+PR builds the packages and runs `changeset publish`.
+
+Publishing authenticates via npm OIDC trusted publishing - no token secrets.
+Each published package's npm settings trust this exact workflow filename under
+the GitHub `release` environment (deployment branches restricted to `main`).
+Renaming this file breaks every npm-side config. `changeset publish` skips
+versions already on the registry, so re-running a failed job completes a
+partial release.
+
+First publish of a new package cannot use OIDC (npm requires the package to
+exist before a trusted publisher attaches) - publish a stub manually, attach
+the trusted publisher, then release normally.

.github/workflows/pr.yml

@@ -0,0 +1,35 @@
+name: PR
+
+on:
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: pr-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    if: github.actor != 'github-actions[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - uses: ./.github/actions/setup
+
+      - run: bun run test
+
+      - run: bun run build
+
+      - name: Changeset reminder
+        continue-on-error: true
+        run: bunx changeset status --since origin/main
+
+      - name: Pack validation
+        continue-on-error: true
+        run: |
+          for pkg in sql sqlite postgres orm; do
+            (cd packages/$pkg && npm publish --dry-run)
+          done

.github/workflows/release.yml

@@ -2,27 +2,35 @@ name: Release
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
+
+concurrency: release
+
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
 
 jobs:
   release:
-    if: false
     runs-on: ubuntu-latest
+    environment: release
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v2
-        with:
-          version: 8
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+
+      - uses: ./.github/actions/setup
+
+      - name: Setup node (npm >= 11.5.1 for OIDC publish)
+        uses: actions/setup-node@v5
         with:
-          node-version: 20
-          registry-url: 'https://registry.npmjs.org'
-      - run: pnpm install --frozen-lockfile
-      - name: Publish to npm
+          node-version: 24
+
+      - name: Version PR or publish
         uses: changesets/action@v1
         with:
-          publish: true
+          version: bun run ci:version
+          publish: bun run ci:publish
+          commit: 'chore: version packages'
+          title: 'chore: version packages'
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package.json

@@ -16,13 +16,15 @@
 		"nuke": "find . -name 'node_modules' -type d -prune -exec rm -rf '{}' +"
 	},
 	"devDependencies": {
+		"@changesets/changelog-github": "^0.7.0",
 		"@changesets/cli": "^2.27.12",
 		"@types/bun": "^1.3.14",
 		"@types/node": "^18.19.0",
 		"tslib": "^2.3.0",
 		"typescript": "^5.8.2"
 	},
 	"engines": {
-		"node": ">=20"
-	}
+		"node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+	},
+	"packageManager": "bun@1.3.14"
 }