Add Github release workflow

[pedropiloto]

Description

Add Github release workflow.

Related Issues

N/A

[Copilot]

Pull request overview

This PR introduces GitHub Actions automation for CI and releases, replacing the previous Travis badge and manual/local release steps with a workflow-driven process based on release-it.

Changes:

• Add a CI workflow to run lint + tests on pull requests and pushes.
• Add a release workflow that can be manually triggered to bump versions and publish releases.
• Switch release documentation and README status badge to point at GitHub Actions workflows.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
README.md	Updates status badge to GitHub Actions and documents the new automated release process.
package.json	Adds release-it tooling and a release script, removes old changelog/version scripts.
.release-it.js	Introduces release-it configuration for changelog, tagging, publishing, and GitHub releases.
.github/workflows/tests.yaml	Adds CI workflow running lint/tests across a Node matrix.
.github/workflows/release.yaml	Adds a manual release workflow intended to bump/tag/publish and create a GitHub release.

Suppressed comments (1)

.release-it.js:18

• git add CHANGELOG.md dist --all is likely to treat --all as a pathspec (since it comes after the paths) and fail with a “pathspec '--all' did not match” error. Put the flag first (or use -A).

      'git add CHANGELOG.md dist --all'

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[marioviana]

🤖 This review was assisted by Claude (Uphold's uphold-javascript-code-review skill).

Summary

CI is green (Node 22/24, lint, Cycode scans), but note CI never actually exercises release.yaml (it's workflow_dispatch-only), so the green checks don't validate the release/publish path itself.

Critical

• npm publish will fail on first real run — no NODE_AUTH_TOKEN/NPM_TOKEN configured despite registry-url + id-token: write. See inline comment.

Security

• A secret is interpolated directly into a run: shell script instead of via env:. See inline comment.

Maintenance (non-blocking)

• package.json's engines.node (>=0.10, unchanged by this PR) is now stale/misleading: the new release-it@^21.0.2 devDependency actually requires Node ≥22, matching the new tests.yaml matrix but not the declared engines field. Suggest bumping engines.node to reflect the real floor (e.g. >=22) in a follow-up.
• tests.yaml missing a concurrency group — see inline comment.

Clean

• package-lock.json: npm-only sources, sha512 integrity on all 808 packages, no typosquat-like names, versions match package.json.
• Static analysis (YAML syntax, .release-it.js key ordering, line length, README/script updates): no issues.

[marioviana]

[critical] npm publish will fail here despite the OIDC setup

registry-url is set, but neither this workflow nor .release-it.js (npm: { publish: true }) ever sets NODE_AUTH_TOKEN or an NPM_TOKEN secret — only id-token: write is granted.

Issue: actions/setup-node unconditionally writes //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN} into .npmrc whenever registry-url is set. With NODE_AUTH_TOKEN unset, npm treats that as "auth configured" (empty token) and skips the OIDC/Trusted-Publishing exchange entirely, so npm publish fails with ENEEDAUTH/E404 (see actions/setup-node#1551, npm/documentation#1960).

Fix — pick one:

• Add env: { NODE_AUTH_TOKEN: "" } to this step and confirm this package has a Trusted Publisher configured on npmjs.org for this repo/workflow, or
• Drop registry-url and rely purely on OIDC per npm's trusted-publishing docs, or
• Add a classic NPM_TOKEN secret and set NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} in the "Generate release" step's env:.

[pedropiloto]

This is consistent with similar repos such as process-manager with the change introduced on PR and validator.js-asserts with the change introduced on PR.
So I think this comment is not suitable here 🤔

[marioviana]

[security] Secret templated directly into a run: script instead of via env:

Issue: ${{ secrets.RELEASE_GITHUB_TOKEN }} is substituted literally into the shell command text before execution (unlike the next step, which correctly passes the same-pattern secret through env: GITHUB_TOKEN). The raw token ends up baked into the composed command and written in plaintext to ~/.gitconfig for the rest of the job.

Fix:

- name: Configure git
  env:
    RELEASE_GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
  run: |
    git config user.name "Uphold"
    git config user.email "bot@uphold.com"
    git config --global url.https://${RELEASE_GITHUB_TOKEN}@github.com/.insteadOf https://github.com/

[marioviana]

[maintenance] No concurrency group on this workflow

Issue: Unlike the new release.yaml in this same PR, this workflow has no concurrency block. Rapid pushes to a branch with an open PR trigger duplicate full Node 22/24 matrices (once for push, once for pull_request) with nothing cancelling superseded runs.

Fix:

concurrency:
  group: tests-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true