From 167dd94c3399f8d91915a5699b47609e798923f3 Mon Sep 17 00:00:00 2001
From: Isaac Besora Vilardaga <isaac.besora@gmail.com>
Date: Fri, 4 Sep 2026 16:18:11 +0200
Subject: [PATCH] Add npm-release

---
 .github/workflows/npm-release.yml | 18 ++++++++++++++++++
 CONTRIBUTING.md                   | 21 ++++++++++++++++-----
 2 files changed, 34 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/npm-release.yml

diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml
new file mode 100644
index 0000000..5d6742f
--- /dev/null
+++ b/.github/workflows/npm-release.yml
@@ -0,0 +1,18 @@
+name: Publish
+on:
+  push:
+    tags: ['v*']
+permissions:
+  id-token: write
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: npm-release
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+      - run: npm ci
+      - run: npm test
+      - run: npm publish --access public
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index ef882d3..b1a82dd 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,7 +1,18 @@
 # Deploying a new release
 
- - `npm test`
- - `npm version {patch|minor|major}`
- - `npm publish`
- - `git push --follow-tags`
- - `aws s3 cp --acl public-read mapbox-gl-supported.js s3://mapbox-gl-js/plugins/mapbox-gl-supported/v$(node --print --eval "require('./package.json').version")/mapbox-gl-supported.js`
+Publishing to npm happens via [Trusted Publishing](https://docs.npmjs.com/trusted-publishers) through the `.github/workflows/npm-release.yml` GitHub Actions workflow, triggered by pushing a `v*` tag.
+
+**One-time setup** (already done for this repo, kept here for reference):
+
+- GitHub repo settings → Environments → New environment → `npm-release`
+- Selected branches and tags → Add rule → Ref type: Tag → `v*`
+- On npmjs.com, configure this repo + workflow + `npm-release` environment as a Trusted Publisher for `@mapbox/mapbox-gl-supported`
+
+**Releasing**:
+
+- `npm version {patch|minor|major}`
+- Push the version bump commit as a PR. Get it green, approved and merged.
+- Once everything looks good, `git push --tags` to release. This triggers the `npm-release` workflow, which publishes to npm.
+- Upload the built browser bundle to the CDN:
+  - `npm run build`
+  - `aws s3 cp --acl public-read mapbox-gl-supported.js s3://mapbox-gl-js/plugins/mapbox-gl-supported/v$(node --print --eval "require('./package.json').version")/mapbox-gl-supported.js`