ci: add tag-triggered npm release workflow with provenance

tkirda-bison · claude · tkirda-bison · commit 97483f1a400b · 2026-05-19T22:31:28.000-05:00
Adds .github/workflows/release.yml that fires on git tag v*. Steps:
verify the tag matches package.json version, run the full ci sweep
(lint, format:check, typecheck, test, build), npm publish with --provenance
via Trusted Publisher (OIDC, no NPM_TOKEN), then gh release create with
auto-generated notes.

Also:
- package.json files: add license.txt so the canonical license ships in
  the tarball (was missing after dist/license.txt was removed in the 2.0.0
  rewrite).
- index.htm: point script tag at dist/ since src/jquery.autocomplete.js
  no longer exists.

One-time setup the maintainer must do on npmjs.com before the first tag:
configure a Trusted Publisher pointing at this repo + release.yml +
"npm-publish" environment. See the comment at the top of the workflow.

Co-Authored-By: Claude Opus 4.7 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -0,0 +1,58 @@
+name: Release
+
+# Fires when a tag like v2.0.0 is pushed. Validates the tag matches
+# package.json, runs the full CI sweep, publishes to npm with provenance
+# (OIDC via Trusted Publisher — no NPM_TOKEN needed), then opens a GitHub
+# Release with auto-generated notes.
+#
+# One-time setup required on npmjs.com before this can fire:
+#   npmjs.com -> Package settings -> "Trusted publisher" ->
+#     repo: devbridge/jQuery-Autocomplete
+#     workflow: release.yml
+#     environment: npm-publish
+# See https://docs.npmjs.com/trusted-publishers
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: npm-publish
+    permissions:
+      id-token: write   # OIDC token for npm provenance
+      contents: write   # creating the GitHub Release
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - run: npm ci
+
+      - name: Verify tag matches package.json version
+        run: |
+          tag_version="${GITHUB_REF_NAME#v}"
+          pkg_version="$(node -p "require('./package.json').version")"
+          if [ "$tag_version" != "$pkg_version" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match package.json version $pkg_version" >&2
+            exit 1
+          fi
+
+      - run: npm run lint
+      - run: npm run format:check
+      - run: npm run typecheck
+      - run: npm test
+      - run: npm run build
+
+      - run: npm publish --provenance --access public
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release create "$GITHUB_REF_NAME" --generate-notes --verify-tag
diff --git a/index.htm b/index.htm
@@ -1,48 +1,53 @@
 ﻿<!DOCTYPE html>
 <html xmlns="http://www.w3.org/1999/xhtml">
+
 <head>
     <title>DevBridge Autocomplete Demo</title>
     <link href="content/styles.css" rel="stylesheet" />
 </head>
+
 <body>
     <div class="container">
         <h1>Ajax Autocomplete Demo</h1>
 
         <h2>Ajax Lookup</h2>
         <p>Type country name in english:</p>
         <div style="position: relative; height: 80px;">
-            <input type="text" name="country" id="autocomplete-ajax" style="position: absolute; z-index: 2; background: transparent;"/>
-            <input type="text" name="country" id="autocomplete-ajax-x" disabled="disabled" style="color: #CCC; position: absolute; background: transparent; z-index: 1;"/>
+            <input type="text" name="country" id="autocomplete-ajax"
+                style="position: absolute; z-index: 2; background: transparent;" />
+            <input type="text" name="country" id="autocomplete-ajax-x" disabled="disabled"
+                style="color: #CCC; position: absolute; background: transparent; z-index: 1;" />
         </div>
         <div id="selction-ajax"></div>
-        
+
         <h2>Local Lookup and Grouping</h2>
         <p>Type NHL or NBA team name:</p>
         <div>
-            <input type="text" name="country" id="autocomplete"/>
+            <input type="text" name="country" id="autocomplete" />
         </div>
         <div id="selection"></div>
 
         <h2>Custom Lookup Container</h2>
         <p>Type country name in english:</p>
         <div>
-            <input type="text" name="country" id="autocomplete-custom-append" style="float: left;"/>
+            <input type="text" name="country" id="autocomplete-custom-append" style="float: left;" />
             <div id="suggestions-container" style="position: relative; float: left; width: 400px; margin: 10px;"></div>
         </div>
     </div>
-    
+
     <div style="width: 50%; margin: 0 auto; clear: both;">
         <h2>Dynamic Width</h2>
         <p>Type country name in english:</p>
         <div>
-            <input type="text" name="country" id="autocomplete-dynamic" style="width: 100%; border-width: 5px;"/>
+            <input type="text" name="country" id="autocomplete-dynamic" style="width: 100%; border-width: 5px;" />
         </div>
     </div>
 
     <script type="text/javascript" src="https://code.jquery.com/jquery-3.7.1.min.js"></script>
     <script type="text/javascript" src="https://unpkg.com/jquery-mockjax@2.6.0/dist/jquery.mockjax.js"></script>
-    <script type="text/javascript" src="src/jquery.autocomplete.js"></script>
+    <script type="text/javascript" src="dist/jquery.autocomplete.js"></script>
     <script type="text/javascript" src="scripts/countries.js"></script>
     <script type="text/javascript" src="scripts/demo.js"></script>
 </body>
+
 </html>
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -55,6 +55,7 @@
   },
   "files": [
     "dist/",
-    "readme.md"
+    "readme.md",
+    "license.txt"
   ]
 }

Original file line number	Diff line number	Diff line change
`@@ -55,6 +55,7 @@`
`55`	`55`	`},`
`56`	`56`	`"files": [`
`57`	`57`	`"dist/",`
`58`		`- "readme.md"`
	`58`	`+ "readme.md",`
	`59`	`+ "license.txt"`
`59`	`60`	`]`
`60`	`61`	`}`