feat: automate releases with semantic-release and npm OIDC trusted publishing

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
         strategy:
             matrix:
                 os: [windows-latest, ubuntu-latest]
-                node_version: [16]
+                node_version: [24]
         name: CI on NodeJS v${{ matrix.node_version }} and ${{ matrix.os }}
         runs-on: ${{ matrix.os }}
         steps:

.github/workflows/lint-pr.yml

@@ -0,0 +1,21 @@
+name: 'Lint PR'
+
+on:
+    pull_request:
+        branches: [master]
+
+jobs:
+    lint-pr:
+        # This job validates the PR title against the conventional commit format. Needed for semantic-release to generate release notes.
+        name: Validate PR title
+        runs-on: ubuntu-latest
+        steps:
+            - uses: amannn/action-semantic-pull-request@v5
+              with:
+                  types: |
+                      fix
+                      feat
+                      chore
+                      revert
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,40 @@
+name: Release
+on:
+    workflow_dispatch:
+        inputs:
+            cliArgs:
+                description: 'CLI args'
+                required: false
+                default: ''
+
+# Least-privilege token for semantic-release. id-token is required for npm
+# OIDC trusted publishing (no NPM_TOKEN needed) and npm provenance.
+permissions:
+    contents: write
+    issues: write
+    pull-requests: write
+    id-token: write
+
+jobs:
+    release:
+        name: Release
+        runs-on: ubuntu-latest
+        # Must match the environment configured on the npm trusted publisher.
+        # Also applies the production environment's required-reviewer gate.
+        environment: production
+        steps:
+            - uses: actions/checkout@v6
+
+            # Do NOT set registry-url here: it writes an .npmrc that conflicts
+            # with semantic-release's OIDC authentication.
+            # Node 26 bundles npm >= 11.5.1, required for OIDC trusted publishing.
+            - uses: actions/setup-node@v6
+              with:
+                  node-version: 26
+
+            - run: yarn install --frozen-lockfile
+
+            - name: Release
+              env:
+                  GITHUB_TOKEN: ${{ secrets.FLOW_GITHUB_TOKEN }}
+              run: npx semantic-release ${{ github.event.inputs.cliArgs }}

CONTRIBUTING.md

@@ -8,61 +8,43 @@ yarn test       # run tests
 yarn ci         # full check: lint, type-check, tests, build
 ```
 
-## Publishing a new release
-
-### 1. Update the changelog
-
-Add an entry at the top of `CHANGELOG.md` following the existing format:
+## Conventional commits
 
-```md
-## v<version> - <date>
+This project uses [semantic-release](https://semantic-release.gitbook.io/) to
+automate versioning and publishing. The next version number, the changelog, and
+the npm release are all derived from commit messages, so commits must follow the
+[Conventional Commits](https://www.conventionalcommits.org/) format:
 
--   `methodName`: description of the change
 ```
-
-Commit it:
-
-```sh
-git add CHANGELOG.md
-git commit -m "Changelog"
-```
-
-### 2. Bump the version
-
-Use `npm version` to bump `package.json` and create the git commit and tag in
-one step:
-
-```sh
-npm version patch   # bug fixes
-npm version minor   # new features, backwards-compatible changes
-npm version major   # breaking changes
+<type>: <description>
 ```
 
-This creates a commit (e.g. `5.2.0`) and a tag (e.g. `v5.2.0`) automatically.
+Pull requests are squash-merged, and the PR title becomes the commit message
+that semantic-release analyses. The `Lint PR` workflow validates that every PR
+title uses one of the accepted types:
 
-### 3. Push commits and tags
+| Type     | Release | When to use                                |
+| -------- | ------- | ------------------------------------------ |
+| `feat`   | minor   | A new feature, backwards-compatible        |
+| `fix`    | patch   | A bug fix                                  |
+| `chore`  | none    | Tooling, docs, or maintenance (no release) |
+| `revert` | patch   | Reverting a previous change                |
 
-```sh
-git push && git push --tags
-```
-
-### 4. Publish to npm
-
-```sh
-npm publish
-```
+A breaking change triggers a major release. Mark it by appending `!` after the
+type (for example `feat!: drop support for legacy bridge`) or by adding a
+`BREAKING CHANGE:` footer in the PR description.
 
-The `prepublishOnly` hook runs the full CI suite (`lint`, `type-check`, `tests`,
-`build`) before publishing. Fix any failures before retrying.
+## Publishing a new release
 
-### 5. Create a GitHub release
+Releases are fully automated; there is no manual version bump, tag, or
+`npm publish` step. Publishing from a local machine is blocked by the
+`prepublishOnly` hook.
 
-```sh
-gh release create v<version> --generate-notes
-```
+To publish, run the **Release** GitHub Actions workflow
+(`.github/workflows/release.yml`) via _Run workflow_:
 
-For example, for `v5.2.0`:
+https://github.com/Telefonica/webview-bridge/actions?query=workflow%3ARelease
 
-```sh
-gh release create v5.2.0 --generate-notes
-```
+semantic-release then inspects the commits merged since the last release,
+determines the next version, updates `CHANGELOG.md`, publishes to npm, and
+creates the matching GitHub release and git tag.

package.json

@@ -16,7 +16,8 @@
         "ts-check": "tsc --project tsconfig.json --noEmit",
         "fix-code": "yarn lint -- --fix && yarn prettier -- --write",
         "ci": "yarn prettier-check && yarn lint && yarn ts-check && yarn test --ci && yarn build",
-        "prepublishOnly": "yarn ci"
+        "prepublishOnly": "node scripts/prepublish-only.js",
+        "prepack": "yarn build"
     },
     "repository": {
         "type": "git",
@@ -29,6 +30,8 @@
     },
     "homepage": "https://github.com/tef-dig/webview-bridge#readme",
     "devDependencies": {
+        "@semantic-release/changelog": "^6.0.3",
+        "@semantic-release/git": "^10.0.1",
         "@types/gtag.js": "^0.0.10",
         "@types/jest": "^27.0.3",
         "@typescript-eslint/eslint-plugin": "^5.6.0",
@@ -41,9 +44,20 @@
         "rimraf": "^3.0.2",
         "rollup": "^2.61.0",
         "rollup-plugin-typescript2": "^0.31.1",
+        "semantic-release": "^25.0.0",
         "ts-jest": "^27.1.1",
         "typescript": "^4.5.3",
         "uglify-es": "^3.3.9"
     },
-    "dependencies": {}
+    "dependencies": {},
+    "release": {
+        "plugins": [
+            "@semantic-release/commit-analyzer",
+            "@semantic-release/release-notes-generator",
+            "@semantic-release/changelog",
+            "@semantic-release/npm",
+            "@semantic-release/git",
+            "@semantic-release/github"
+        ]
+    }
 }

scripts/prepublish-only.js

@@ -0,0 +1,12 @@
+if (!process.env.CI) {
+    const lines = [
+        '',
+        'Cannot publish from this machine',
+        '',
+        'To publish, use the  Github Release action workflow:',
+        'https://github.com/Telefonica/webview-bridge/actions?query=workflow%3ARelease',
+        '',
+    ];
+    console.error(lines.join('\n'));
+    process.exit(1);
+}