ci: manage releases with release-please

.claude/CLAUDE.md

@@ -13,13 +13,31 @@ pnpm run build         # Build all entry points to dist/ via vp pack
 pnpm run dev           # Build in watch mode
 pnpm test              # Run tests via vp test
 pnpm run check         # Lint + format + type check via vp check
-pnpm run release       # Bump version, commit, push, tag via bumpp
 ```
 
 Pre-commit hook runs `vp check --fix` on staged files.
 
 After any significant code change, always run `vp check --fix` to ensure lint, formatting, and type checking pass before committing.
 
+## Releasing
+
+Releases are driven by [release-please](https://github.com/googleapis/release-please) from
+conventional commit messages on `main` (`feat:` `fix:` `chore:` `ci:`, with `!` or a
+`BREAKING CHANGE:` footer for majors).
+
+1. Merge PRs to `main` as usual.
+2. release-please keeps an open `chore(main): release x.y.z` PR that bumps
+   `package.json`, `src/version.ts` and `CHANGELOG.md`.
+3. Merge that PR. release-please tags it and creates the GitHub Release, then the
+   `publish` job builds and publishes to npm via OIDC trusted publishing.
+
+Never bump the version or create a tag by hand — release-please owns both, and
+`.release-please-manifest.json` is the source of truth for the current version. To force a
+specific version, put `Release-As: 1.2.3` in a commit footer.
+
+`src/version.ts` carries an `x-release-please-version` marker so it is bumped alongside
+`package.json`; `tests/version.test.ts` fails if the two ever drift.
+
 ## Documentation Rules
 
 After any significant code change, update the following:

.github/workflows/release.yml

@@ -1,34 +1,45 @@
 name: Release
 
 on:
-  release:
-    types: [published]
+  push:
+    branches: [main]
 
 permissions:
   contents: write
-  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
 
 jobs:
-  release:
-    name: Release Package
+  release-please:
+    name: Release PR
+    runs-on: ubuntu-latest
+    outputs:
+      released: ${{ steps.release.outputs.release_created }}
+      tag: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  publish:
+    name: Publish to npm
+    needs: release-please
+    if: needs.release-please.outputs.released == 'true'
     runs-on: ubuntu-latest
     environment: release
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - name: Checkout main
+      - name: Checkout release tag
         uses: actions/checkout@v6
         with:
-          ref: main
-          fetch-depth: 0
-
-      - name: Resolve version from release tag
-        env:
-          TAG: ${{ github.event.release.tag_name }}
-        run: |
-          if ! echo "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then
-            echo "::error::Release tag '$TAG' is not a vSEMVER tag (e.g. v0.0.6, v10.1.11)."
-            exit 1
-          fi
-          echo "VERSION=${TAG#v}" >> "$GITHUB_ENV"
+          ref: ${{ needs.release-please.outputs.tag }}
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -54,30 +65,13 @@ jobs:
       - name: Run tests
         run: bun run test
 
-      - name: Bump to the released version
-        env:
-          TAG: ${{ github.event.release.tag_name }}
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          npm version "$VERSION" --no-git-tag-version --allow-same-version
-          printf '/** SDK version string sent with every API request. */\nexport const SDK_VERSION: string = "%s";\n' "$VERSION" > src/version.ts
-          if git diff --quiet; then
-            echo "Already at $VERSION"
-          else
-            git commit -am "chore: release v$VERSION"
-            git push origin HEAD:main
-          fi
-          git tag -f "$TAG"
-          git push -f origin "refs/tags/$TAG"
-
       - name: Build
         run: bun run build
 
       # No NODE_AUTH_TOKEN: auth comes from OIDC trusted publishing.
       # Requires a trusted publisher configured on npmjs.com for this repo,
       # workflow (release.yml), and the "release" environment.
-      - name: Publish to npm
+      - name: Publish
         run: npm pack && npm publish ./*.tgz --access public --provenance
         env:
           NPM_CONFIG_PROVENANCE: true

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.5"
+}

release-please-config.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": true,
+  "packages": {
+    ".": {
+      "release-type": "node",
+      "changelog-path": "CHANGELOG.md",
+      "include-component-in-tag": false,
+      "extra-files": ["src/version.ts"]
+    }
+  }
+}

src/version.ts

@@ -1,2 +1,2 @@
 /** SDK version string sent with every API request. */
-export const SDK_VERSION: string = "0.0.5";
+export const SDK_VERSION: string = "0.0.5"; // x-release-please-version