[q3ndro-sent]

Add GitHub Actions CI and npm Publish Workflows

Changes / Fixes / Features included

• CI workflow (.github/workflows/ci.yml): runs on pull requests, pushes to main and manual dispatch, on Node 22 (the engines floor) and Node 24 (the README's recommendation). Steps: npm ci, npm run check:generated, lint, tests, npm audit --omit=dev --audit-level=moderate on the shipped dependency tree only, npm pack --dry-run, and two greps that fail the run if a force-added local artifact is tracked or a risky construct (child_process, eval(, TLS verification disabled) appears in shipped sources.
• Publish workflow (.github/workflows/publish.yml): triggered by a bare version tag (0.1.0, not v0.1.0), mirroring sentdm/n8n-nodes-sent. It checks the tag equals the version in package.json and that the version is not already on npm, reruns every CI gate on the tagged commit (there is no build step, so the checkout is the artifact), publishes with npm provenance and public access, then waits for the npm packument to list the version and prints the provenance attestation as release evidence.
• First-release bootstrap: npm can attach a Trusted Publisher only to a package that already exists, so the initial publish authenticates with a short-lived NPM_TOKEN repository secret. Once 0.1.0 is live, the Trusted Publisher is configured on npm, the secret is deleted and the token revoked; later releases authenticate through the job's OIDC token with no secret at all. The handover and the release procedure are documented in the workflow header.
• Supply chain: both actions are pinned to commit SHAs (actions/checkout v7.0.1, actions/setup-node v7.1.0). The publish job installs npm 11.21.1 because Node 22 bundles npm 10, which cannot do Trusted Publishing. registry-url is deliberately not set on setup-node; it writes a placeholder auth token that stops npm from attempting OIDC, which is what broke the first OIDC release of the n8n package.
• .gitignore: allowlist entries for the two workflow files. The file is a /* allowlist, so without them the workflows are ignored.

No runtime, editor or package contents change. npm pack --dry-run still lists the same 13 files.

How to test?

1. CI runs on this PR. Both matrix entries (Node 22 and 24) should be green.
2. Locally, the same gates:

   npm ci
   npm run check:generated
   npm run lint
   npm test
   npm audit --omit=dev --audit-level=moderate
   npm pack --dry-run

3. First release, after merge:
   • An npm org owner creates a short-lived granular access token limited to the @sentdm scope and stores it as the NPM_TOKEN repository secret.
   • Confirm CI is green on the main commit to be released, then git tag -a 0.1.0 -m 'Release 0.1.0' and git push origin 0.1.0.
   • The Publish run must end with the packument step printing @sentdm/node-red-sent@0.1.0 with a dist.attestations entry.
   • Configure the Trusted Publisher on npm (GitHub Actions, owner sentdm, repository node-red, workflow publish.yml, environment blank), delete the NPM_TOKEN secret and revoke the token.
   • Submit the package at https://flows.nodered.org/add/node and check its scorecard.

[arbianst]

CI green on Node 22 and 24, publish flow matches n8n-nodes-sent, NPM_TOKEN bootstrap secret is in place.