chore: automate release workflow

Author: V3RON

.github/workflows/release.yml

@@ -0,0 +1,64 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: Release mode to run
+        required: true
+        type: choice
+        options:
+          - stable
+          - rc
+          - canary
+
+permissions:
+  contents: write
+  id-token: write
+
+concurrency:
+  group: release-${{ github.event.inputs.mode }}-${{ github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  release:
+    name: Run release
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      RELEASE_MODE: ${{ github.event.inputs.mode }}
+      RELEASE_REF: ${{ github.ref_name }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
+      NPM_CONFIG_PROVENANCE: true
+      GIT_AUTHOR_NAME: actions-bot
+      GIT_AUTHOR_EMAIL: actions-bot@users.noreply.github.com
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Configure git identity
+        run: |
+          git config user.name "$GIT_AUTHOR_NAME"
+          git config user.email "$GIT_AUTHOR_EMAIL"
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.6.1
+
+      - name: Setup Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: 24.10.0
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run release
+        run: pnpm release:run

CONTRIBUTING.md

@@ -43,6 +43,8 @@ This project uses GitHub Actions to run validation checks on your pull requests.
 
 Currently, releases are published by maintainers when they determine it's time to do so. Usually, there is at least one release per week as long as there are changes waiting to be published.
 
+The release workflow and branch conventions are documented in [RELEASING.md](/RELEASING.md).
+
 ## License
 
 By contributing to React Native Harness, you agree that your contributions will be licensed under its MIT license.

RELEASING.md

@@ -0,0 +1,29 @@
+# Releasing
+
+Releases are run with `.github/workflows/release.yml`.
+
+The workflow always uses the branch it is dispatched from. There is no manual ref input.
+
+## Stable releases
+
+Run the workflow from `main` with `mode=stable`.
+
+This applies pending version plans, publishes packages with the default npm dist-tag, pushes the release commit and tag, and creates the GitHub release.
+
+## RC releases
+
+Run the workflow from `release/v<version>` branches, for example `release/v1.1` or `release/v1.1.0`, with `mode=rc`.
+
+`rc` mode is intentionally restricted to `release/v<version>` branches and will fail on `main`.
+
+RC releases consume version plans from `.nx/version-plans`, publish packages with the `rc` dist-tag, and create a prerelease on GitHub.
+
+## Canary releases
+
+Run the workflow from any branch with `mode=canary`.
+
+Canary releases publish a unique prerelease version for the current commit with the `canary` dist-tag. They do not create a commit, tag, or GitHub release.
+
+## Required secrets
+
+The workflow expects `NPM_ACCESS_TOKEN` to be configured in GitHub Actions secrets.

package.json

@@ -6,7 +6,8 @@
     "build:all": "nx run-many -t build",
     "lint:all": "nx run-many -t lint",
     "test:all": "nx run-many -t test",
-    "typecheck:all": "nx run-many -t typecheck"
+    "typecheck:all": "nx run-many -t typecheck",
+    "release:run": "node ./scripts/release/release.mjs"
   },
   "private": true,
   "devDependencies": {