fix: npm publish workflow

.github/workflows/npm-publish.yml

@@ -0,0 +1,84 @@
+name: npm-publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: npm-publish-${{ github.event.release.tag_name || github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    name: Validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.release.tag_name || github.ref }}
+          persist-credentials: false
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20.x
+          cache: npm
+
+      - name: verify release version
+        if: github.event_name == 'release'
+        run: |
+          pkg_name=$(jq -r .name package.json)
+          pkg_version=$(jq -r .version package.json)
+          tag_version="${GITHUB_EVENT_RELEASE_TAG_NAME#v}"
+          if [ "$pkg_version" != "$tag_version" ]; then
+            echo "package.json version ($pkg_version) does not match release tag ($tag_version)"
+            exit 1
+          fi
+          if npm view "${pkg_name}@${pkg_version}" version >/dev/null 2>&1; then
+            echo "${pkg_name}@${pkg_version} is already published"
+            exit 1
+          fi
+        env:
+          GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
+
+      - name: install dependencies
+        run: npm ci
+
+      - name: run tests
+        run: make test
+        env:
+          TEST_SKIP_IP_V6: true
+
+      - name: validate publish package contents
+        run: |
+          npm pack --dry-run 2>&1 | tee pack.log
+          grep -q 'lib/index.js' pack.log
+          grep -q 'bin/report-latency' pack.log
+          ! grep -qE '[[:space:]]test/' pack.log
+          ! grep -qE '[[:space:]]tools/' pack.log
+
+  publish:
+    name: publish
+    needs: validate
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    environment: Publish
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20.x
+          registry-url: https://registry.npmjs.org
+
+      - name: publish to npm
+        run: npm publish --provenance

.github/workflows/release-please.yml

@@ -3,13 +3,17 @@ on:
     branches:
       - master
       - 9.x
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
 name: release-please
 jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: GoogleCloudPlatform/release-please-action@v3.6.1
+      - uses: googleapis/release-please-action@v5
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           release-type: node
-          package-name: restify
+          target-branch: ${{ github.ref_name }}

.gitignore

@@ -10,7 +10,6 @@ docs/*.json
 nbproject
 deps/javascriptlint
 deps/jsstyle
-package-lock.json
 benchmark/results
 .nyc_output/
 coverage/

CONTRIBUTING.md

@@ -50,16 +50,21 @@ make benchmark
 
 ## Cutting a release
 
-Cutting a release is currently a manual process. We use a [Conventional Changelog](http://conventionalcommits.org/) to simplify the process of managing semver on this project. Generally, the following series of commands will cut a release from the `master` branch:
+Releases are automated with [release-please](https://github.com/googleapis/release-please) and published to npm via GitHub Actions. We use [Conventional Commits](http://conventionalcommits.org/) to simplify the process of managing semver on this project — release-please parses commit types (`fix`, `feat`, etc.) to determine the version bump.
 
-```
-$ git fetch
-$ git pull origin master # ensure you have the latest changes
-$ npx unleash [-p for patch, -m for minor, -M for major] --no-publish -d # do a dry run to verify
-$ npx unleash [-p for patch, -m for minor, -M for major] --no-publish 
-# Unleash doesnt support 2FA, hence we use --no-publish flag here.
-# This ensures we have the package.json updated, changelog generated, tag created
-# and all the changes into origin
-# Next, publish to npm manually and do not forget to provide the 2FA code.
-$ npm publish
-```
+### Release flow
+
+1. Merge pull requests to `master` using [Conventional Commits](http://conventionalcommits.org/).
+2. `release-please` opens or updates a **Release PR** with the version bump and changelog.
+3. Review and merge the Release PR when ready to ship.
+4. `release-please` creates a GitHub Release and version tag (for example `v11.3.0`).
+5. The `npm-publish` workflow runs automatically, re-runs tests, validates the package contents (`npm pack --dry-run`), then pauses at the `Publish` environment for reviewer approval.
+6. After approval, the package is published to npm via [Trusted Publishing](https://docs.npmjs.com/trusted-publishers) (OIDC). Do not run `npm publish` manually.
+
+### Dry run
+
+To validate the publish workflow without publishing, run **Actions → npm-publish → Run workflow**. This runs tests and `npm pack --dry-run`.
+
+### Retrying a failed run
+
+If `npm-publish` fails, use **Re-run jobs** on the failed run itself (Actions tab) — it replays the same release/tag, so there's no need to cut a new one. This is safe even if `publish` partially ran, since `validate` checks whether the version is already on npm before continuing.