From 39b8f273a97b25746e54e61f261d6ee39fb093c0 Mon Sep 17 00:00:00 2001
From: Simone Primarosa <simone.primarosa@gmail.com>
Date: Mon, 8 Jun 2026 11:22:34 +0200
Subject: [PATCH] ci: automate releases with release-please and npm trusted
 publishing

On merge to main, release-please maintains a release PR (version bump
from conventional commits); merging it tags the release and publishes to
npm via OIDC trusted publishing. The committed changelog file is skipped
since the GitHub release already carries the notes. A pr-title check
keeps squash-merge titles conventional.
---
 .github/workflows/pr-title.yml       | 24 +++++++++++++++
 .github/workflows/release-please.yml | 44 ++++++++++++++++++++++++++++
 .release-please-manifest.json        |  3 ++
 release-please-config.json           | 11 +++++++
 4 files changed, 82 insertions(+)
 create mode 100644 .github/workflows/pr-title.yml
 create mode 100644 .github/workflows/release-please.yml
 create mode 100644 .release-please-manifest.json
 create mode 100644 release-please-config.json

diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
new file mode 100644
index 0000000..0a79085
--- /dev/null
+++ b/.github/workflows/pr-title.yml
@@ -0,0 +1,24 @@
+name: pr-title
+
+# PRs are squash-merged, so the PR title becomes the commit on main. This
+# keeps that title a valid conventional commit so release-please can derive
+# the next version and changelog from it.
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+      - reopened
+
+permissions:
+  pull-requests: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
new file mode 100644
index 0000000..e2f938f
--- /dev/null
+++ b/.github/workflows/release-please.yml
@@ -0,0 +1,44 @@
+name: release-please
+
+on:
+  push:
+    branches:
+      - main
+
+# Restrict the default token; each job opts into what it needs.
+permissions: {}
+
+jobs:
+  # Maintains a "release PR" that bumps the version and updates the changelog
+  # from the conventional commits merged into main. Merging that PR tags the
+  # release and creates the GitHub release, which triggers the publish job.
+  release-please:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - uses: googleapis/release-please-action@v4
+        id: release
+
+  # Publishes to npm only once release-please has cut a release. Uses npm
+  # trusted publishing (OIDC) so no long-lived token is stored in the repo;
+  # the trusted publisher must be configured for pidtree on npmjs.com.
+  publish:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      # Trusted publishing requires npm >= 11.5.0.
+      - run: npm install -g npm@latest
+      - run: npm publish --provenance
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
new file mode 100644
index 0000000..bcd0522
--- /dev/null
+++ b/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "0.6.0"
+}
diff --git a/release-please-config.json b/release-please-config.json
new file mode 100644
index 0000000..13103af
--- /dev/null
+++ b/release-please-config.json
@@ -0,0 +1,11 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "last-release-sha": "1a25bdd19beb179eebcad17f2cfe9e9268a4bca5",
+  "packages": {
+    ".": {
+      "release-type": "node",
+      "package-name": "pidtree",
+      "skip-changelog": true
+    }
+  }
+}