Test out this new fangled trusted publishing thing

Author: pimterry

.github/workflows/ci.yml

@@ -30,10 +30,45 @@ jobs:
           POSTHOG_PERF_API_KEY: ${{ secrets.POSTHOG_PERF_API_KEY }}
 
       - name: Deploy docs
-        if: github.ref == 'refs/heads/main' && matrix.node-version == 'v22.14.0'
+        if: github.ref == 'refs/heads/main' && matrix.node-version == 'v22.20.0'
         uses: JamesIves/github-pages-deploy-action@v4
         with:
           single-commit: true
           branch: gh-pages
           folder: typedoc
 
+  publish:
+    name: Publish to npm
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment:
+      name: npm
+      url: https://www.npmjs.com/package/mockttp
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 'v22.20.0'
+          registry-url: 'https://registry.npmjs.org'
+          cache: 'npm'
+
+      - run: npm ci
+
+      - name: Verify tag matches package.json version
+        run: |
+          TAG_VERSION=${GITHUB_REF#refs/tags/v}
+          PACKAGE_VERSION=$(node -p "require('./package.json').version")
+          if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then
+            echo "Error: Tag version (v$TAG_VERSION) does not match package.json version ($PACKAGE_VERSION)"
+            exit 1
+          fi
+          echo "✓ Tag version matches package.json version: $PACKAGE_VERSION"
+
+      - run: npm publish
+