ci: automate releases with release-please and npm provenance

.github/workflows/release-please.yml

@@ -0,0 +1,37 @@
+name: release-please
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: googleapis/release-please-action@v5
+        id: release
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  npm-publish:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: lts/*
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm ci --omit=dev
+      - run: npm publish --access public --provenance

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "10.0.2"
+}

RELEASES.md

@@ -6,33 +6,15 @@ for citgm, hosted on npm.
 
 ## Who can make a release?
 
-Any member of the @nodejs/citgm team can make a release.
+Anyone with permission to merge the release PR to `main` can make a release.
 
-## How to create a release
+## How releases work
 
-1. Ensure your branch is up to date with upstream
+Releases are automated via the
+[release-please workflow](.github/workflows/release-please.yml) using
+[Conventional Commits](https://www.conventionalcommits.org/). When a release PR
+is merged, the package is published to npm automatically with provenance.
 
-```bash
-$ git checkout main
-$ git remote update -p
-$ git reset --hard upstream/main
-$ git diff upstream/main # this should be a no-op
-```
+### npm Trusted Publishing
 
-2. Bump the version and create tag with semver-sync
-
-```bash
-$ npm version [<newversion> | major | minor | patch]
-```
-
-3. Push to github
-
-```bash
-$ git push upstream main --follow-tags
-```
-
-4. Publish to npm
-
-```bash
-$ npm publish
-```
+The workflow publishes via GitHub OIDC — no `NPM_TOKEN` secret is needed.

release-please-config.json

@@ -0,0 +1,14 @@
+{
+  "packages": {
+    ".": {
+      "release-type": "node",
+      "changelog-sections": [
+        { "type": "feat", "section": "Features" },
+        { "type": "fix", "section": "Bug Fixes" },
+        { "type": "lookup", "section": "Lookup Updates", "hidden": true }
+      ],
+      "version-bump-minor-types": ["feat"],
+      "version-bump-patch-types": ["fix", "lookup"]
+    }
+  }
+}