feat(workflows): switch to an integrated release-and-publish workflow

this is needed because events triggered by a GITHUB_TOKEN do not create new workflow runs.

a sad day for automation 🥲

.github/workflows/release-and-publish.yml

@@ -0,0 +1,62 @@
+name: Release and Publish
+
+on:
+    workflow_call:
+        secrets:
+            READONLY_NPM_TOKEN:
+                description: Needed to install private @hedia npm packages
+                required: true
+            PUBLISHING_NPM_TOKEN:
+                description: Needed to publish @hedia npm packages
+                required: true
+
+permissions:
+    contents: write
+    pull-requests: write
+
+jobs:
+    release-and-publish:
+        runs-on: ubuntu-latest
+        if: >
+            github.event_name == 'workflow_dispatch' ||
+            (github.event_name == 'pull_request' &&
+              github.event.pull_request.merged == true &&
+              contains(github.event.pull_request.labels.*.name, 'autorelease: pending')
+            )
+        steps:
+            - uses: google-github-actions/release-please-action@v3
+              id: release
+              with:
+                  release-type: node
+
+            - if: steps.release.outputs.release_created == 'true'
+              name: Checkout Repository
+              uses: actions/checkout@v3
+              with:
+                  ref: ${{ github.ref }}
+                  fetch-depth: 1
+
+            - if: steps.release.outputs.release_created == 'true'
+              name: Setup Node.js Environment
+              uses: actions/setup-node@v3
+              with:
+                  node-version-file: "package.json"
+                  always-auth: true
+                  registry-url: https://registry.npmjs.org
+                  scope: "@hedia"
+
+            - if: steps.release.outputs.release_created == 'true'
+              name: Install Dependencies
+              run: npm ci
+              env:
+                  NODE_AUTH_TOKEN: ${{ secrets.READONLY_NPM_TOKEN }}
+
+            - if: steps.release.outputs.release_created == 'true'
+              name: Build
+              run: npm run build --if-present
+
+            - if: steps.release.outputs.release_created == 'true'
+              name: Publish to npm
+              run: npm publish
+              env:
+                  NODE_AUTH_TOKEN: ${{ secrets.PUBLISHING_NPM_TOKEN }}