Update release workflow and drop Node v20 support

.github/workflows/ci.yaml

@@ -7,15 +7,15 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node: [20, 22]
+        node: [22, 24, 26]
     name: Node v${{ matrix.node }}
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Setup Node.js version
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ matrix.node }}
 

.github/workflows/release.yaml

@@ -1,51 +1,86 @@
 name: Release
 
 on:
+  push:
+    tags:
+      - 'v*'
   workflow_dispatch:
     inputs:
-      VERSION_BUMP:
-        description: 'The version bump'
-        type: choice
-        options:
-        - major
-        - minor
-        - patch
-        default: minor
+      tag:
+        description: 'The tag to release (e.g. v10.1.0)'
         required: true
+        type: string
+
+permissions: {}
 
 jobs:
   release:
-    environment: release
     runs-on: ubuntu-latest
+    environment: release
     concurrency:
-      group: release-${{ github.repository }}-${{ github.ref_name }}
+      group: release-${{ github.event.inputs.tag || github.ref_name }}
       cancel-in-progress: false
     permissions:
       contents: write
       id-token: write
 
     steps:
+    - name: Resolve version tag
+      id: resolve-version-tag
+      run: echo "tag=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_OUTPUT"
+
+    - name: Check for existing GitHub release
+      id: check-github-release
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        if gh release view "${{ steps.resolve-version-tag.outputs.tag }}" --repo "${{ github.repository }}" >/dev/null 2>&1; then
+          echo "GitHub release ${{ steps.resolve-version-tag.outputs.tag }} already exists, skipping"
+          echo "exists=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "exists=false" >> "$GITHUB_OUTPUT"
+        fi
+
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
+        ref: ${{ steps.resolve-version-tag.outputs.tag }}
+        fetch-depth: 0
         persist-credentials: false
 
     - name: Setup Node.js version
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24
         registry-url: https://registry.npmjs.org/
 
-    - name: Install dependencies
-      run: yarn install --frozen-lockfile
+    # OIDC trusted publishing requires npm v11.5.1+.
+    - name: Update npm
+      run: npm install -g npm@12.0.2
 
-    - name: Configure git
+    - name: Check for existing npm release
+      id: npmRelease
       run: |
-        git config user.name "Uphold"
-        git config user.email "bot@uphold.com"
-        git config --global url.https://${{ secrets.RELEASE_GITHUB_TOKEN }}@github.com/.insteadOf https://github.com/
+        NAME=$(node -p "require('./package.json').name")
+        VERSION=$(node -p "require('./package.json').version")
+        if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
+          echo "$NAME@$VERSION is already published, skipping"
+          echo "exists=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "exists=false" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Install dependencies
+      run: yarn install --frozen-lockfile
 
     - name: Generate release
       env:
-        GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
-      run: npm run release -- --increment "${{ github.event.inputs.VERSION_BUMP }}" -V
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        GITHUB_RELEASE_ARG=--github.release
+        NPM_PUBLISH_ARG=--npm.publish
+
+        [[ "${{ steps.check-github-release.outputs.exists }}" == 'true' ]] && GITHUB_RELEASE_ARG=--no-github.release
+        [[ "${{ steps.npmRelease.outputs.exists }}" == 'true' ]] && NPM_PUBLISH_ARG=--no-npm.publish
+
+        npx release-it --no-increment --no-git "$GITHUB_RELEASE_ARG" "$NPM_PUBLISH_ARG"

.release-it.js

@@ -1,24 +1,27 @@
+/** @type {import('release-it').Config} */
 module.exports = {
   git: {
     changelog: 'echo "## Changelog\n\n$(npx @uphold/github-changelog-generator -f unreleased | tail -n +4 -f)"',
     commitMessage: 'Release ${version}',
     requireBranch: 'master',
     requireCleanWorkingDir: false,
     requireCommits: true,
+    tag: false,
     tagName: 'v${version}'
   },
   github: {
-    release: true,
+    release: false,
     releaseName: 'v${version}'
   },
   hooks: {
     'after:bump': [
       'echo "$(npx @uphold/github-changelog-generator -f v${version})\n$(tail -n +2 CHANGELOG.md)" > CHANGELOG.md',
       'git add CHANGELOG.md --all'
-    ]
+    ],
+    'before:init': 'test -n "$GITHUB_TOKEN" || (echo "GITHUB_TOKEN is not set" >&2; exit 1)'
   },
   npm: {
-    publish: true,
+    publish: false,
     skipChecks: true
   }
 };

README.md

@@ -387,7 +387,12 @@ npm test
 
 ## Release process
 
-The release of a version is automated via the [release](https://github.com/uphold/validator.js-asserts/actions/workflows/release.yaml) GitHub workflow. Run it by clicking the "Run workflow" button.
+Releasing is a two-step process:
+
+1. A release commit is pushed, via Pull Request (or an admin running `release-it` locally).
+2. Once merged, a release must be created and pushed for that release commit. Upon pushing this tag, the [release](https://github.com/uphold/validator.js-asserts/actions/workflows/release.yaml) workflow will generate the GitHub release and publish the package to NPM.
+
+The workflow can also be triggered manually with a specific tag via manual dispatch.
 
 ## License
 

package.json

@@ -64,7 +64,7 @@
     "isoc": "0.0.1",
     "moment": "^2.30.1",
     "prettier": "^3.5.3",
-    "release-it": "^19.2.3",
+    "release-it": "^21.0.2",
     "tin-validator": "^1.1.0",
     "uk-modulus-checking": "0.0.3",
     "urijs": "^1.17.1",
@@ -134,7 +134,13 @@
     }
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
+  },
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": ">=24"
+    }
   },
   "optionalPeerDependencies": {
     "@randyd45/curp-validation": "1.0.4",