ci: semantic releases

.github/dependabot.yml

@@ -5,6 +5,10 @@ updates:
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    groups:
+      commitlint:
+        patterns:
+          - "@commitlint/*"
   - package-ecosystem: github-actions
     directory: "/"
     schedule:

.github/workflows/tests.yml

@@ -7,29 +7,39 @@ on:
   push:
     branches:
       - master    # although master is push protected we still keep it
-      - development
   pull_request:   # runs on all PR
-    branches-ignore:
-      - release-* # on release, we run an extended workflow so no need for this
 
 jobs:
   lint:
-    name: Javascript Biome lint/format
+    name: Lint commit messages and code
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
           persist-credentials: false
           show-progress: false
+          fetch-depth: 0
 
       - name: setup node
         uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm
-      - run: |
-          npm clean-install
+
+      - name: Install npm dependencies
+        run: npm clean-install
+
+      - name: Validate pushed commits with commitlint
+        if: github.event_name == 'push'
+        run: npx commitlint --from ${{ github.event.before }} --to ${{ github.sha }} --verbose
+
+      - name: Validate PR commits with commitlint
+        if: github.event_name == 'pull_request'
+        run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
+
+      - name: Lint and format code
+        run: |
           npm run lint
           npm run format
 
@@ -62,3 +72,43 @@ jobs:
       with:
         path: './coverage/lcov.info'
         min_coverage: 98
+
+  release:
+    name: Release
+    concurrency: release
+    if: ${{ github.event_name == 'push' && github.actor != 'dependabot[bot]' }}
+    runs-on: ubuntu-latest
+    needs: [lint, unittest]
+    permissions:
+      contents: write # to be able to publish a GitHub release & commit changelog changes
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable OIDC for npm trusted publishing and provenance
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false # semantic-release must push with RELEASE_GITHUB_TOKEN
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          package-manager-cache: false # no cache in a job that can publish
+      - name: Release
+        env:
+          NPM_CONFIG_PROVENANCE: true
+          # Prefer a dedicated PAT (e.g. to push the release commit/tag to the
+          # protected `master` branch); fall back to the built-in token otherwise.
+          GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+        # Dependabot can't update these pins. Keep the preset on 9.x until semantic-release 26.
+        # --ignore-scripts also applies to the npm commands that semantic-release runs.
+        # The package has no lifecycle scripts today.
+        run: >-
+          npx --yes --ignore-scripts --min-release-age=7
+          --package=semantic-release@25.0.9
+          --package=@semantic-release/changelog@6.0.3
+          --package=@semantic-release/git@10.0.1
+          --package=conventional-changelog-conventionalcommits@9.3.1
+          semantic-release
+

AGENTS.md

@@ -5,9 +5,9 @@
 These instructions apply only to the `node-oauth2-server` repository, the framework-agnostic OAuth 2.0 server library
 published as `@node-oauth/oauth2-server`.
 
-The sibling `express-oauth-server` repository is outside this file’s scope. Release CI checks out the Express adapter
-as an external integration-test target; it is not a runtime dependency of this package. Changes to the adapter’s code,
-documentation, security policy, and release process are outside this scope.
+The sibling `express-oauth-server` repository is outside this file’s scope. The Express adapter is not a runtime
+dependency of this package. Changes to the adapter’s code, documentation, security policy, and release process are
+outside this scope.
 
 Run package commands from the `node-oauth2-server` repository root; do not expect a parent workspace-level install or
 test command. Before changing the package, check `README.md`, `CONTRIBUTING.md`, `SECURITY.md`, and `package.json`.
@@ -150,17 +150,17 @@ changing the library’s support policy merely to match the local toolchain.
   repository root.
 - Edit the guide under `docs/guide/` directly. `npm run docs:setup` creates the contribution-guide link used by the docs
   build; edit the root `CONTRIBUTING.md` rather than `docs/guide/contributing.md`.
-- Use the `docs:*` scripts in `package.json`; the `npm run docs` example in `CONTRIBUTING.md` is outdated.
+- Use the `docs:*` scripts in `package.json`.
 - Keep README, API documentation, migration notes, and type declarations aligned with behavior. Do not update generated
   output without checking whether the corresponding source change is present.
-- Do not edit `CHANGELOG.md` or bump release versions for ordinary feature or bug-fix pull requests; maintainers handle
-  release bookkeeping.
+- Do not edit `CHANGELOG.md` or bump release versions in pull requests; semantic-release updates both when it releases
+  from `master`.
 
 ## Contributions and Git workflow
 
 Follow [`CONTRIBUTING.md`](./CONTRIBUTING.md) for the established contribution process, including opening or discussing
 an issue before an ordinary feature or bug-fix pull request. Follow the private reporting process below for security
-issues. The branching policy below takes precedence over the guide’s outdated `development` instructions.
+issues.
 
 Use trunk-based development with `master` as the trunk. The `development` branch is deprecated. Create feature or fix
 branches from `master`, keep them closely aligned with it, and target pull requests to `master`. The `master` name is

CHANGELOG.md

@@ -1,4 +1,4 @@
-## Changelog
+# Changelog
 
 ## 5.0.0