Summary

• .github/workflows/npm-release.yml: new workflow_dispatch workflow that publishes to npm and creates a GitHub release using OIDC Trusted Publishing — no npm tokens required.
• CONTRIBUTING.md: documents the release process — bump version, update CHANGELOG, merge PR, trigger workflow from Actions tab.
• package.json: patch version bump and publishConfig: { access: "public" } for the scoped package.

Prerequisites before merging

The workflow uses an npm-release GitHub Environment as a release gate. Before merging, create it in this repo:

1. Go to Settings → Environments → New environment, name it npm-release
2. Under Deployment branches, restrict to the default branch (main)
3. Under Required reviewers, add your team (or mapbox/team-mapbox to allow any Mapbox employee to approve)

Without this environment, the workflow will fail when triggered.

Trigger: once merged, run from the Actions tab → NPM release → Run workflow → approve the environment gate.

Ticket: https://mapbox.atlassian.net/browse/CLOUDPLAT-3162