docs: add `SECURITY.md` pointing to Tidelift (#5210) #12

	name: Release Please

	on:
	push:
	branches:
	- main

	permissions:
	contents: read

	jobs:
	release_please:
	name: release-please
	runs-on: ubuntu-latest
	outputs:
	releaseCreated: ${{ steps.release.outputs.release_created }}
	permissions:
	contents: write
	pull-requests: write
	steps:
	- uses: googleapis/release-please-action@v4
	id: release
	with:
	config-file: .github/release-please/config.json
	manifest-file: .github/release-please/manifest.json

	npm_publish:
	name: Publish to npm
	runs-on: ubuntu-latest
	environment: npm
	needs: release_please
	if: needs.release_please.outputs.releaseCreated
	permissions:
	id-token: write
	steps:
	- uses: actions/checkout@v4
	with:
	show-progress: false
	- uses: actions/setup-node@v4
	with:
	node-version: lts/*
	registry-url: 'https://registry.npmjs.org'

	- name: Install dependencies
	run: npm ci --ignore-scripts --force --no-fund --no-audit

	- run: npm publish --provenance --access public
	env:
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Provide feedback