feat(javascript): add npm publishing workflow and release scripts (#4076)

This PR implements the npm publishing and release scripts for the
Node.js Driver Manager.

- ci/scripts/node_npm_upload.sh — publishes platform + main packages to
an npm registry
- packaging.yml — upload-npm job publishes to npm with --tag next on
schedule or manual dispatch
- dev/release/post-09-npm.sh — release manager script to publish
official releases
  - dev/release/02-sign.sh — GPG signing for npm tarballs
- dev/release/utils-prepare.sh — JavaScript version bumping added to
release preparation
- Package renamed to `apache-arrow/adbc-driver-manager` with proper
versioning (0.23.0)

**Test Plan**

Tested packaging and npm publishing against a local proxy registry from
my fork
- [Action Run:
22973831085](https://github.com/kentkwu/arrow-adbc/actions/runs/22973831085/job/66698340917)

```sh
# Start a local Verdaccio registry
docker run -d --name verdaccio-adbc-test -p 4873:4873 verdaccio/verdaccio
sleep 3

# Create a test user and capture the auth token
TOKEN=$(curl -s -X PUT http://localhost:4873/-/user/org.couchdb.user:testuser \
  -H "Content-Type: application/json" \
  -d '{"name":"testuser","password":"testpass","type":"user"}' \
  | jq -r '.token')

# Download CI-built packages from a workflow run
gh run download 22973831085 --repo kentkwu/arrow-adbc --name node-packages --dir /tmp/node-packages

# Publish to local registry
NPM_TOKEN="${TOKEN}" \
NPM_REGISTRY=http://localhost:4873 \
  ./ci/scripts/node_npm_upload.sh /tmp/node-packages/

# Verify - note: needs at symbol before apache-arrow
npm view apache-arrow/adbc-driver-manager optionalDependencies --registry http://localhost:4873

# Clean up
docker rm -f verdaccio-adbc-test
```

<img width="1234" height="1095" alt="Screenshot 2026-03-11 at 5 02
26 PM"
src="https://github.com/user-attachments/assets/072635ea-285e-468e-9a6c-008c7018b174"
/>


Tested `utils-prepare.sh` increments version

```sh
SOURCE_DIR=./dev/release
source "$SOURCE_DIR/utils-common.sh"
source "$SOURCE_DIR/utils-prepare.sh"
VERSION_JS="0.99.0"
update_versions "release"
```

Verified the following files updated to `0.99.0`:
- `javascript/package.json` — main version and all
`optionalDependencies`
- `javascript/npm/*/package.json` — all 5 platform packages
- `javascript/Cargo.toml`

Closes #4051

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: kentkwu

.github/workflows/javascript.yml

@@ -111,11 +111,7 @@ jobs:
       - name: Build
         working-directory: javascript
         shell: bash
-        run: |
-          npx napi build --platform --release --target ${{ matrix.settings.target }}
-          mv index.js binding.js
-          mv index.d.ts binding.d.ts
-          npx tsc
+        run: npm run build:ci -- --target ${{ matrix.settings.target }} && npm run build:ts
       - name: Ad-hoc sign binary (macOS)
         if: runner.os == 'macOS'
         working-directory: javascript

.github/workflows/packaging.yml

@@ -47,7 +47,6 @@ on:
         required: true
         type: boolean
         default: false
-
 concurrency:
   group: ${{ github.repository }}-${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
@@ -1190,13 +1189,18 @@ jobs:
           cache: 'npm'
           cache-dependency-path: adbc/javascript/package-lock.json
 
+      - name: Setup Rust
+        run: |
+          rustup toolchain install stable --no-self-update
+          rustup default stable
+
       - name: Install Node dependencies
         working-directory: adbc/javascript
         run: npm ci
 
-      - name: Build Node.js JS
+      - name: Build Node.js
         working-directory: adbc/javascript
-        run: npm run build:ts
+        run: npm run build:ci && npm run build:ts
 
       - name: Download Node.js binaries
         uses: actions/download-artifact@v8
@@ -1226,6 +1230,7 @@ jobs:
           path: |
             adbc/javascript/*.tgz
 
+
   release:
     name: "Create release"
     runs-on: ubuntu-latest
@@ -1272,7 +1277,7 @@ jobs:
             -exec mv '{}' upload-staging \;
 
           # Handle Node.js packages (in tarball form)
-          find ./release-artifacts/ -name 'adbc-driver-manager-*.tgz' -exec mv '{}' upload-staging \;
+          find ./release-artifacts/ -name 'apache-arrow-adbc-driver-manager-*.tgz' -exec mv '{}' upload-staging \;
 
           UPLOAD=$(find upload-staging -type f | sort | uniq)
 
@@ -1357,6 +1362,7 @@ jobs:
     needs:
       - clean-gemfury
       - java
+      - node-dist
       - python-manylinux
       - python-macos
       - python-windows
@@ -1380,13 +1386,18 @@ jobs:
               -name '*.jar' -or \
               -name '*.pom' -or \
               -name '*.whl' -or \
-              -name 'adbc_*.tar.gz' \
+              -name 'adbc_*.tar.gz' -or \
+              -name 'apache-arrow-adbc-driver-manager-*.tgz' \
             ')' \
             -exec mv '{}' upload-staging \;
 
           # Java
           ./ci/scripts/java_jar_upload.sh upload-staging/*.pom
           # Python
           ./ci/scripts/python_wheel_upload.sh upload-staging/adbc_*.tar.gz upload-staging/*.whl
+          # Node.js
+          ./ci/scripts/node_npm_upload.sh upload-staging
         env:
           GEMFURY_PUSH_TOKEN: ${{ secrets.GEMFURY_PUSH_TOKEN }}
+          NPM_REGISTRY: https://npm.fury.io/arrow-adbc-nightlies/
+          NPM_TOKEN: ${{ secrets.GEMFURY_PUSH_TOKEN }}

ci/scripts/node_npm_upload.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Publish Node.js packages to an npm registry.
+#
+# Usage: ./ci/scripts/node_npm_upload.sh <packages_dir>
+#
+# Environment variables:
+#   NPM_TOKEN        npm authentication token (required)
+#   NPM_REGISTRY     registry URL (default: https://registry.npmjs.org)
+#   NPM_TAG          dist-tag to publish under (default: latest)
+#   DRY_RUN          set to 1 to pass --dry-run to npm publish
+
+set -euo pipefail
+
+main() {
+    local packages_dir
+    packages_dir="$(realpath "$1")"
+    local registry="${NPM_REGISTRY:-https://registry.npmjs.org}"
+    local dry_run_flag=""
+    if [[ "${DRY_RUN:-0}" == "1" ]]; then
+        dry_run_flag="--dry-run"
+    fi
+    local tag_flag=""
+    if [[ -n "${NPM_TAG:-}" ]]; then
+        tag_flag="--tag ${NPM_TAG}"
+    fi
+
+    # Write a temp .npmrc with the auth token for the target registry
+    local npmrc
+    npmrc=$(mktemp)
+    trap "rm -f ${npmrc}" EXIT
+    echo "//${registry#*://}/:_authToken=${NPM_TOKEN:-}" > "${npmrc}"
+    export NPM_CONFIG_USERCONFIG="${npmrc}"
+
+    # Publish platform-specific packages first, then the main package
+    for pkg in "${packages_dir}"/apache-arrow-adbc-driver-manager-*-*.tgz; do
+        echo "==== Publishing ${pkg}"
+        npm publish "${pkg}" --access public --registry "${registry}" ${tag_flag} ${dry_run_flag}
+    done
+
+    echo "==== Publishing main package"
+    npm publish "${packages_dir}"/apache-arrow-adbc-driver-manager-[0-9]*.tgz \
+        --access public --registry "${registry}" ${tag_flag} ${dry_run_flag}
+}
+
+main "$@"

dev/release/02-sign.sh

@@ -80,6 +80,9 @@ main() {
     header "Upload signatures for Python"
     upload_asset_signatures "${tag}" $(find "${download_dir}" -type f \( -name '*.whl' -or -name 'adbc_*.tar.gz' \))
 
+    header "Upload signatures for Node.js"
+    upload_asset_signatures "${tag}" $(find "${download_dir}" -type f -name 'apache-arrow-adbc-driver-manager-*.tgz')
+
     header "Upload signatures for docs"
     upload_asset_signatures "${tag}" "${download_dir}/docs.tgz"
 

dev/release/post-09-npm.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# -*- indent-tabs-mode: nil; sh-indentation: 2; sh-basic-offset: 2 -*-
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+set -e
+set -u
+set -o pipefail
+
+SOURCE_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+source "${SOURCE_DIR}/utils-common.sh"
+source "${SOURCE_DIR}/utils-prepare.sh"
+
+main() {
+  if [ "$#" -ne 0 ]; then
+    echo "Usage: $0"
+    exit
+  fi
+
+  local -r tag="apache-arrow-adbc-${RELEASE}"
+  local -r tmp=$(mktemp -d -t "arrow-post-npm.XXXXX")
+
+  header "Downloading Node.js packages for ${RELEASE}"
+
+  gh release download \
+     --repo "${REPOSITORY}" \
+     "${tag}" \
+     --dir "${tmp}" \
+     --pattern "apache-arrow-adbc-driver-manager-*.tgz"
+
+  header "Uploading Node.js packages for ${RELEASE}"
+
+  DRY_RUN="${DRY_RUN:-0}" "${SOURCE_TOP_DIR}/ci/scripts/node_npm_upload.sh" "${tmp}"
+
+  rm -rf "${tmp}"
+
+  echo "Success! The released npm package is available here:"
+  echo "  https://www.npmjs.com/package/@apache-arrow/adbc-driver-manager"
+}
+
+main "$@"

…/release/post-09-remove-old-artifacts.sh …/release/post-10-remove-old-artifacts.shdev/release/post-09-remove-old-artifacts.sh renamed to dev/release/post-10-remove-old-artifacts.sh dev/release/post-09-remove-old-artifacts.sh renamed to dev/release/post-10-remove-old-artifacts.sh

@@ -23,6 +23,7 @@ update_versions() {
 
   local conda_version="${VERSION_NATIVE}"
   local csharp_version="${VERSION_CSHARP}"
+  local js_version="${VERSION_JS}"
   local linux_version="${RELEASE}"
   local rust_version="${VERSION_CSHARP}"
   case ${type} in
@@ -67,6 +68,7 @@ update_versions() {
   echo "GLib/Ruby: ${glib_version}"
   echo "Java: ${java_version}"
   echo "Linux: ${linux_version}"
+  echo "JavaScript: ${js_version}"
   echo "Python: ${py_version}"
   echo "R: ${r_version}"
   echo "Rust: ${rust_version}"
@@ -153,6 +155,18 @@ update_versions() {
   cargo check --manifest-path "${ADBC_DIR}/rust/Cargo.toml"
   git add "${ADBC_DIR}/rust/Cargo.lock"
 
+  pushd "${ADBC_DIR}/javascript"
+  sed -i.bak -E \
+    -e "s/^  \"version\": \".+\"/  \"version\": \"${js_version}\"/" \
+    -e "s/(\"@apache-arrow\/adbc-driver-manager[^\"]*\"): \".+\"/\1: \"${js_version}\"/g" \
+    package.json
+  rm package.json.bak
+  npx --yes napi version
+  sed -i.bak -E "s/^version = \".+\"/version = \"${js_version}\"/" Cargo.toml
+  rm Cargo.toml.bak
+  git add package.json package-lock.json Cargo.toml npm/*/package.json
+  popd
+
   if [ ${type} = "release" ]; then
     pushd "${ADBC_DIR}/ci/linux-packages"
     rake version:update VERSION=${linux_version}