chore: import upstream snapshot with attribution

.github/workflows/cli-publish.yml

@@ -0,0 +1,122 @@
+name: CLI Publish
+
+# Publishes @vidbee/cli to npm when a `cli-vX.Y.Z` tag is pushed. Standalone
+# from the Desktop release pipeline (NEX-148): the CLI ships independently
+# so a `yt-dlp` probe-flag fix doesn't have to wait for a Desktop release.
+
+on:
+  push:
+    tags:
+      - 'cli-v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to publish (cli-vX.Y.Z). When empty, builds from main but skips publish.'
+        required: false
+        default: ''
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - name: Resolve version from tag
+        id: meta
+        shell: bash
+        run: |
+          ref="${GITHUB_REF_NAME}"
+          if [[ -n "${{ github.event.inputs.tag }}" ]]; then
+            ref="${{ github.event.inputs.tag }}"
+          fi
+          if [[ "$ref" == cli-v* ]]; then
+            version="${ref#cli-v}"
+            echo "version=$version" >> "$GITHUB_OUTPUT"
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+            if [[ "$version" == *-* ]]; then
+              echo "tag=next" >> "$GITHUB_OUTPUT"
+            else
+              echo "tag=latest" >> "$GITHUB_OUTPUT"
+            fi
+          else
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
+            echo "version=" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.1.2
+
+      - name: Install dependencies
+        run: pnpm install --filter ./apps/cli... --frozen-lockfile
+
+      - name: Verify package.json version matches tag
+        if: steps.meta.outputs.publish == 'true'
+        shell: bash
+        run: |
+          tag_version="${{ steps.meta.outputs.version }}"
+          pkg_version=$(node -p "require('./apps/cli/package.json').version")
+          if [[ "$pkg_version" != "$tag_version" ]]; then
+            echo "::error::Tag $tag_version does not match apps/cli/package.json version $pkg_version"
+            exit 1
+          fi
+
+      - name: Run CLI tests
+        run: pnpm --filter @vidbee/cli test
+
+      - name: Run CLI typecheck
+        run: pnpm --filter @vidbee/cli typecheck
+
+      - name: Build CLI bundle
+        run: pnpm --filter @vidbee/cli build
+
+      - name: Verify dist artifacts exist
+        run: pnpm --filter @vidbee/cli verify-dist
+
+      - name: Pack tarball (sanity-check files whitelist)
+        run: |
+          cd apps/cli
+          pnpm pack --pack-destination ../..
+
+      - name: Publish to npm
+        if: steps.meta.outputs.publish == 'true'
+        run: |
+          cd apps/cli
+          pnpm publish --no-git-checks --access public --tag ${{ steps.meta.outputs.tag }}
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create GitHub Release
+        if: steps.meta.outputs.publish == 'true'
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: '@vidbee/cli ${{ steps.meta.outputs.version }}'
+          body: |
+            `@vidbee/cli@${{ steps.meta.outputs.version }}` published to npm.
+
+            Install:
+            ```sh
+            npm install -g @vidbee/cli@${{ steps.meta.outputs.version }}
+            pnpm add -g @vidbee/cli@${{ steps.meta.outputs.version }}
+            bun install -g @vidbee/cli@${{ steps.meta.outputs.version }}
+            ```
+
+            See `apps/cli/CHANGELOG.md` for release notes.
+          files: |
+            *.tgz
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}