chore: add GitHub Actions workflow for publishing to npm

[interstellarmt]

• add GitHub Actions workflow for publishing to npm

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical tag validation, authentication, and shell-safety issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 3 · 1

Open (4)

• Missing NODE_AUTH_TOKEN causes npm publishing authentication failure · New
• Unquoted tag interpolation enables shell command injection · New
• Prerelease tags beyond beta publish to the stable npm channel · New
• Tag glob accepts invalid versions without package version validation · New

What changed in this PR

Adds a GitHub Actions workflow to publish @antv/component to npm from version tags using OIDC authentication.

Changes:

• Configures Node.js, pnpm, dependency installation, and builds.
• Publishes stable and beta releases with appropriate dist-tags.
• Adds npm publishing permissions.

File	Description
.github/​workflows/​publish.yml	Adds the automated npm release workflow.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.