ci: publish Node SDK from GitHub releases

.github/workflows/release-to-discord.yml

@@ -1,17 +1,31 @@
+name: Release to Discord
+
 on:
-  release:
-    types: [ published ]
-  workflow_dispatch:
+  workflow_call:
+    secrets:
+      DISCORD_RELEASE_WEBHOOK_URL:
+        required: false
+
+permissions:
+  contents: read
 
 jobs:
-  github-releases-to-discord:
+  notify:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Discord Release Webhook
+      - name: Check webhook configuration
+        id: webhook
+        env:
+          WEBHOOK_URL: ${{ secrets.DISCORD_RELEASE_WEBHOOK_URL }}
+        run: |
+          if [ -n "$WEBHOOK_URL" ]; then
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Send release notification
+        if: steps.webhook.outputs.configured == 'true'
         uses: lettermint/action-discord-releases@v1.0.1
         with:
           color: '215732'
           webhook_url: ${{ secrets.DISCORD_RELEASE_WEBHOOK_URL }}
-          content: 'A new release for the Lettermint NodeJS SDK is now available! ||@NodeJS||'
+          content: 'A new release for the Lettermint Node.js SDK is now available! @NodeJS'

.github/workflows/release.yaml

@@ -1,25 +1,31 @@
 name: Release
 
 on:
-  push:
-    branches: [main]
-  workflow_dispatch:
+  release:
+    types: [published]
 
 permissions:
-  contents: write
-  id-token: write
-  packages: write
+  contents: read
+
+concurrency:
+  group: release
+  cancel-in-progress: false
 
 jobs:
-  test-and-build:
-    name: Test and Build
+  release:
+    name: Build and Publish
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -31,57 +37,54 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Set version from release tag
+        id: version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          PRERELEASE: ${{ github.event.release.prerelease }}
+        run: |
+          version="${RELEASE_TAG#v}"
+          if ! [[ "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo "Release tag must use 1.2.3 or v1.2.3, with an optional prerelease suffix."
+            exit 1
+          fi
+          npm version "$version" --no-git-tag-version --allow-same-version --ignore-scripts
+          if [[ "$(node -p "require('./package.json').version")" != "$version" ]]; then
+            echo "The package version must match the release tag without the v prefix."
+            exit 1
+          fi
+          if [[ "$PRERELEASE" == 'true' || "$version" == *-* ]]; then
+            echo "dist-tag=next" >> "$GITHUB_OUTPUT"
+          else
+            echo "dist-tag=latest" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Run linting
+        run: npm run lint
+
+      - name: Run type checking
+        run: npm run type-check
+
       - name: Run tests
-        run: npm run test
+        run: npm test -- --runInBand
 
       - name: Build package
         run: npm run build
 
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: release-artifacts
-          path: |
-            dist/
-            package.json
-            README.md
-            LICENSE
-          retention-days: 30
-
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    needs: test-and-build
-    if: github.ref == 'refs/heads/main'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Download build artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: release-artifacts
-
-      - name: Configure Git
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-      - name: Release
+      - name: Publish to npm
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_CONFIG_ACCESS: public
-        run: npx semantic-release
+          DIST_TAG: ${{ steps.version.outputs.dist-tag }}
+        run: npm publish --access public --tag "$DIST_TAG"
+
+  changelog:
+    needs: release
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: ./.github/workflows/update-changelog.yml
+
+  discord:
+    needs: release
+    uses: ./.github/workflows/release-to-discord.yml
+    secrets:
+      DISCORD_RELEASE_WEBHOOK_URL: ${{ secrets.DISCORD_RELEASE_WEBHOOK_URL }}

.github/workflows/update-changelog.yml

@@ -0,0 +1,47 @@
+name: Update Changelog and Version
+
+on:
+  workflow_call:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update:
+    if: github.event_name == 'release' && !github.event.release.prerelease && !contains(github.event.release.tag_name, '-')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Update package version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: npm version "${RELEASE_TAG#v}" --no-git-tag-version --allow-same-version --ignore-scripts
+
+      - name: Update changelog from release notes
+        uses: stefanzweifel/changelog-updater-action@v1
+        with:
+          latest-version: ${{ github.event.release.tag_name }}
+          release-notes: ${{ github.event.release.body }}
+
+      - name: Open release update pull request
+        uses: peter-evans/create-pull-request@v8
+        with:
+          branch: automation/update-changelog
+          commit-message: Update changelog and package version
+          title: Update changelog and package version
+          body: Update CHANGELOG.md, package.json, and package-lock.json for the published release.
+          add-paths: |
+            CHANGELOG.md
+            package.json
+            package-lock.json