feat: add package-first release flow

.github/workflows/changeset-status.yml

@@ -105,3 +105,6 @@ jobs:
 
       - name: Run registry consumer smoke test
         run: pnpm test:registry:consumer
+
+      - name: Run package consumer smoke test
+        run: pnpm test:package:consumer

.github/workflows/publish-packages.yml

@@ -0,0 +1,66 @@
+name: Publish Packages
+
+on:
+  push:
+    tags:
+      - "cadence-ui-v*"
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.25.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+          scope: "@ai-ui"
+
+      - name: Require npm token
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ -z "${NPM_TOKEN:-}" ]]; then
+            echo "::error::NPM_TOKEN secret is required to publish @ai-ui packages."
+            exit 1
+          fi
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Verify tag matches package version
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected_tag="$(node ./scripts/release-metadata.mjs --field tag)"
+
+          if [[ "${expected_tag}" != "${GITHUB_REF_NAME}" ]]; then
+            echo "::error::Tag ${GITHUB_REF_NAME} does not match package version tag ${expected_tag}."
+            exit 1
+          fi
+
+      - name: Run release validation
+        run: pnpm release:validate
+
+      - name: Publish packages
+        run: pnpm release:publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/release-tag.yml

@@ -0,0 +1,55 @@
+name: Create Release Tag
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+
+jobs:
+  create-tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Detect release version change
+        id: release
+        shell: bash
+        run: |
+          set -euo pipefail
+          changed="$(node ./scripts/release-metadata.mjs --before "${{ github.event.before }}" --field changed)"
+          tag="$(node ./scripts/release-metadata.mjs --field tag)"
+          version="$(node ./scripts/release-metadata.mjs --field version)"
+
+          echo "changed=${changed}" >> "$GITHUB_OUTPUT"
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+
+      - name: Create release tag
+        if: steps.release.outputs.changed == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if git rev-parse --verify "refs/tags/${TAG}" >/dev/null 2>&1; then
+            echo "Tag ${TAG} already exists."
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "${TAG}" -m "Cadence UI ${VERSION}"
+          git push origin "${TAG}"
+        env:
+          TAG: ${{ steps.release.outputs.tag }}
+          VERSION: ${{ steps.release.outputs.version }}

.github/workflows/release-version-pr.yml

@@ -37,8 +37,8 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Run registry consumer smoke test
-        run: pnpm test:registry:consumer
+      - name: Run release validation
+        run: pnpm release:validate
 
       - name: Open or update version PR
         uses: changesets/action@v1