Prepare npm publishing pipeline

- package.json: add repository / bugs / homepage / keywords / author
  for npm listing metadata, add NOTICE to the tarball's files field,
  and add `prepublishOnly` = gen-proto + build so the dist artifacts
  are always fresh at publish time.
- New .github/workflows/release.yml triggers on `v*` tag pushes
  (plus manual workflow_dispatch for replays). It verifies the tag
  matches package.json version, regenerates proto, lints, typechecks,
  runs the full test suite, then publishes to npm with SLSA
  provenance via --provenance (requires id-token: write).

Requires a repository secret `NPM_TOKEN` (granular automation token
scoped to the oxia package) for the publish step.

Signed-off-by: Matteo Merli <mmerli@apache.org>

Author: merlimat

.github/workflows/release.yml

@@ -0,0 +1,76 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+  # Lets a maintainer republish a specific tag manually if the automated
+  # run failed after an issue was fixed out-of-band.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to publish (e.g. v0.1.0)'
+        required: true
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write # required for npm provenance
+
+jobs:
+  publish:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - uses: arduino/setup-protoc@v3
+        with:
+          version: '27.x'
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: npm ci
+
+      - name: Verify package.json version matches tag
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          TAG_VERSION="${TAG#v}"
+          PKG_VERSION="$(node -p "require('./package.json').version")"
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "::error::Tag $TAG declares version $TAG_VERSION but package.json has $PKG_VERSION"
+            exit 1
+          fi
+          echo "Publishing version $PKG_VERSION"
+
+      - name: Generate proto code
+        run: npm run gen-proto
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Typecheck
+        run: npx tsc --noEmit -p tsconfig.json
+
+      - name: Test
+        run: npm test
+
+      - name: Build
+        run: npm run build
+
+      # `prepublishOnly` in package.json runs gen-proto + build again; the
+      # earlier steps are so we get a clean lint/typecheck/test signal before
+      # we touch npm.
+      - name: Publish with provenance
+        run: npm publish --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package.json

@@ -3,6 +3,26 @@
   "version": "0.1.0",
   "description": "Oxia client SDK for Node.js",
   "license": "Apache-2.0",
+  "author": "The Oxia Authors",
+  "homepage": "https://oxia-db.github.io",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/oxia-db/oxia-client-node.git"
+  },
+  "bugs": {
+    "url": "https://github.com/oxia-db/oxia-client-node/issues"
+  },
+  "keywords": [
+    "oxia",
+    "oxia-db",
+    "kv",
+    "key-value",
+    "metadata",
+    "coordination",
+    "distributed",
+    "grpc",
+    "notifications"
+  ],
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -15,7 +35,8 @@
   "files": [
     "dist",
     "src",
-    "proto"
+    "proto",
+    "NOTICE"
   ],
   "engines": {
     "node": ">=18"
@@ -27,13 +48,14 @@
     "test:watch": "vitest",
     "lint": "biome check src test",
     "format": "biome format --write src test",
-    "docs": "typedoc"
+    "docs": "typedoc",
+    "prepublishOnly": "npm run gen-proto && npm run build"
   },
   "dependencies": {
     "@bufbuild/protobuf": "^2.2.0",
     "@grpc/grpc-js": "^1.12.0",
-    "long": "^5.2.3",
-    "@node-rs/xxhash": "^1.7.6"
+    "@node-rs/xxhash": "^1.7.6",
+    "long": "^5.2.3"
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9.0",