From bf799f58713c3d1d96951b027d5df1439905b114 Mon Sep 17 00:00:00 2001
From: Beth Griggs <bethanyngriggs@gmail.com>
Date: Thu, 24 Sep 2026 16:05:24 +0100
Subject: [PATCH 1/2] ci: automate releases with release-please and npm
 provenance

Adds a release-please workflow that opens and maintains a release PR on
every push to main. When the release PR is merged, the package is
published to npm automatically using GitHub OIDC trusted publishing.

Configuration is added so 'lookup:' commits trigger patch releases.

RELEASES.md is updated accordingly.

Signed-off-by: Beth Griggs <bethanyngriggs@gmail.com>
---
 .github/workflows/release-please.yml | 37 ++++++++++++++++++++++++++++
 .release-please-manifest.json        |  3 +++
 RELEASES.md                          | 34 ++++++-------------------
 release-please-config.json           | 14 +++++++++++
 4 files changed, 62 insertions(+), 26 deletions(-)
 create mode 100644 .github/workflows/release-please.yml
 create mode 100644 .release-please-manifest.json
 create mode 100644 release-please-config.json

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
new file mode 100644
index 000000000..bcc6611b3
--- /dev/null
+++ b/.github/workflows/release-please.yml
@@ -0,0 +1,37 @@
+name: release-please
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: googleapis/release-please-action@v5
+        id: release
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  npm-publish:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm ci --omit=dev
+      - run: npm publish --access public --provenance
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
new file mode 100644
index 000000000..952c14008
--- /dev/null
+++ b/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "10.0.2"
+}
diff --git a/RELEASES.md b/RELEASES.md
index 9cb117264..2297a11df 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -6,33 +6,15 @@ for citgm, hosted on npm.
 
 ## Who can make a release?
 
-Any member of the @nodejs/citgm team can make a release.
+Anyone with permission to merge the release PR to `main` can make a release.
 
-## How to create a release
+## How releases work
 
-1. Ensure your branch is up to date with upstream
+Releases are automated via the
+[release-please workflow](.github/workflows/release-please.yml) using
+[Conventional Commits](https://www.conventionalcommits.org/). When a release PR
+is merged, the package is published to npm automatically with provenance.
 
-```bash
-$ git checkout main
-$ git remote update -p
-$ git reset --hard upstream/main
-$ git diff upstream/main # this should be a no-op
-```
+### npm Trusted Publishing
 
-2. Bump the version and create tag with semver-sync
-
-```bash
-$ npm version [<newversion> | major | minor | patch]
-```
-
-3. Push to github
-
-```bash
-$ git push upstream main --follow-tags
-```
-
-4. Publish to npm
-
-```bash
-$ npm publish
-```
+The workflow publishes via GitHub OIDC — no `NPM_TOKEN` secret is needed.
diff --git a/release-please-config.json b/release-please-config.json
new file mode 100644
index 000000000..e27931ba5
--- /dev/null
+++ b/release-please-config.json
@@ -0,0 +1,14 @@
+{
+  "packages": {
+    ".": {
+      "release-type": "node",
+      "changelog-sections": [
+        { "type": "feat", "section": "Features" },
+        { "type": "fix", "section": "Bug Fixes" },
+        { "type": "lookup", "section": "Lookup Updates", "hidden": true }
+      ],
+      "version-bump-minor-types": ["feat"],
+      "version-bump-patch-types": ["fix", "lookup"]
+    }
+  }
+}

From 841f1ea5d51f6735c191b44971d2d49b89149ba6 Mon Sep 17 00:00:00 2001
From: Beth Griggs <bethanyngriggs@gmail.com>
Date: Fri, 25 Sep 2026 10:49:26 +0100
Subject: [PATCH 2/2] fixup! latest actions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Michaël Zasso <targos@protonmail.com>
---
 .github/workflows/release-please.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index bcc6611b3..68eccce26 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -28,8 +28,8 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: lts/*
           registry-url: 'https://registry.npmjs.org'