feat: set up secure npm release automation for Gyros

[Claude]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>Set up secure, transparent npm release automation for Gyros</issue_title>
<issue_description>## Summary
Set up a secure, transparent, repeatable npm release pipeline for Primajin/Gyros so the package can be published and maintained with confidence.

Problem

We want to publish Gyros to npm and get it into users' hands, but the package namespace gyros is already taken. We also need a release process that raises trust and makes it clear that the published package is built directly from this repository's source rather than from an opaque or manually-driven process.

Today, we have an NPM_TOKEN secret configured for Actions with a 90-day token lifetime, and it is not available to Copilot agents or Dependabot. However, we still need to design and implement the release automation around it.

Proposed work

• Determine the package publishing strategy:
  • evaluate an alternative available npm package name, or
  • publish under the user scope if that is the preferred path.
• Copy/adapt the release and commit lint workflows from the sibling project Primajin/webapp-console-log-action.
• Use conventional commits plus Release Please to create a repeatable, auditable release flow.
• Add npm publishing automation that runs after a GitHub Release is created.
• Ensure the publish pipeline is secure and transparent so consumers can verify that the npm artifact corresponds to the source in this repository.

Requirements

• Release automation should be based on GitHub Actions.
• The pipeline should use the existing NPM_TOKEN Actions secret.
• Publishing must not rely on manual local steps.
• The process should make the provenance of the published package easy to understand and inspect.
• The workflow should be modeled after Primajin/webapp-console-log-action where appropriate.

Acceptance criteria

• A package name decision is documented and implemented (new unscoped name or @Primajin/<name> style publishing).
• the users profile is https://www.npmjs.com/~primajin
• Conventional commits and Release Please are configured in Primajin/Gyros.
• A release workflow exists that creates or updates releases in a repeatable way.
• An npm publish workflow exists and runs only after the GitHub release step succeeds.
• The npm publish job uses the NPM_TOKEN secret from GitHub Actions.
• The workflow design clearly demonstrates that published artifacts are generated from the repository source in CI.
• Documentation is added describing how releases are cut and how trust/transparency are maintained.

Implementation notes

Potential implementation details to consider:

• use GitHub Releases as the gate for npm publication;
• ensure package versioning is driven by Release Please;
• consider npm provenance / trusted publishing support if compatible with the repository and package setup;
• document the exact workflow chain so maintainers and users can audit the process.

Reference

Sibling project to mirror/adapt:

• https://github.com/Primajin/webapp-console-log-action</issue_description>
• Closes Set up secure, transparent npm release automation for Gyros #35

Comments on the Issue (you are @claude[agent] in this section)

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://Primajin.github.io/Gyros/pr-preview/pr-36/
Built to branch gh-pages at 2026-07-10 14:01 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[github-actions]

2026-07-10T13:36:05.785Z-iPad_Pro_landscape-d2c05ea.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T13.36.05.785Z-iPad_Pro_landscape-d2c05ea.png

2026-07-10T13:36:05.785Z-iPad_Pro-d2c05ea.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T13.36.05.785Z-iPad_Pro-d2c05ea.png

2026-07-10T13:36:05.785Z-iPhone_13-d2c05ea.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T13.36.05.785Z-iPhone_13-d2c05ea.png

[github-actions]

Console Logs

✅ No logs were captured

[Copilot]

Pull request overview

This PR sets up an automated, auditable release pipeline for Gyros using Release Please and a GitHub Actions–driven npm publish workflow, and updates the package to publish under the @primajin scope.

Changes:

• Configure Release Please (config + manifest) and add a Release Please workflow on main.
• Add an npm publish workflow triggered by GitHub Release publication, publishing @primajin/gyros with provenance.
• Add Conventional Commits contributor documentation and a PR title lint/sync workflow.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
release-please-config.json	Defines Release Please behavior for a Node package and changelog section mapping.
.release-please-manifest.json	Seeds Release Please manifest version tracking for the root package.
.github/workflows/release-please.yml	Adds automation to open/update release PRs and create GitHub Releases/tags.
.github/workflows/npm-publish.yml	Publishes the package to npm on release publication, building from CI and using provenance.
.github/workflows/lint-pr-title.yml	Enforces Conventional Commit–style PR titles and attempts to sync title bump level to commits.
package.json	Switches the npm package name to the scoped @primajin/gyros.
CONTRIBUTING.md	Documents commit conventions, release flow, provenance, and the package naming decision.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

2026-07-10T14:02:18.392Z-iPad_Pro_landscape-42dcd74.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T14.02.18.392Z-iPad_Pro_landscape-42dcd74.png

2026-07-10T14:02:18.392Z-iPad_Pro-42dcd74.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T14.02.18.392Z-iPad_Pro-42dcd74.png

2026-07-10T14:02:18.392Z-iPhone_13-42dcd74.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T14.02.18.392Z-iPhone_13-42dcd74.png

[github-actions]

2026-07-10T14:04:26.491Z-iPad_Pro_landscape-7f66833.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T14.04.26.491Z-iPad_Pro_landscape-7f66833.png

2026-07-10T14:04:26.491Z-iPad_Pro-7f66833.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T14.04.26.491Z-iPad_Pro-7f66833.png

2026-07-10T14:04:26.491Z-iPhone_13-7f66833.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T14.04.26.491Z-iPhone_13-7f66833.png