From 039c0410eecf2601ad79ce61257e8253e6c43109 Mon Sep 17 00:00:00 2001
From: mwaisaida-13 <aidams@amazon.com>
Date: Tue, 22 Sep 2026 14:58:24 +0100
Subject: [PATCH 1/7] Add the npm release workflow for the Node package

Mirrors python-release.yml: on a published node-v* GitHub Release, run the
supported-version test matrix, verify and pack, then publish from the `npm`
environment with OIDC trusted publishing and provenance, and smoke-test the
published package.

Release logic lives in scripts, not YAML:
- scripts/verify.mjs: tag matches package.json's version, `private` is off,
  CHANGELOG.md has an entry for the version, repository.url is set (provenance
  requires it), and optionally npm is new enough for trusted publishing. The
  publish job asserts the npm version instead of installing npm from the
  registry at publish time.
- scripts/smoke.mjs: install the published version into a temporary project
  with retries, import it, check the public exports and the installed version.

package.json gains repository/homepage/bugs (provenance verifies repository.url
against the publishing repository) and publishConfig.access=public, which a
scoped package needs on first publish.

Nothing publishes until a node-v* release is created, the `npm` GitHub
environment exists with required reviewers, and the npm trusted publisher is
configured for the package.
---
 .github/workflows/node-release.yml | 145 +++++++++++++++++++++++++++++
 node/package.json                  |  12 +++
 node/scripts/smoke.mjs             |  95 +++++++++++++++++++
 node/scripts/verify.mjs            |  93 ++++++++++++++++++
 node/test/verify.test.ts           | 136 +++++++++++++++++++++++++++
 5 files changed, 481 insertions(+)
 create mode 100644 .github/workflows/node-release.yml
 create mode 100644 node/scripts/smoke.mjs
 create mode 100644 node/scripts/verify.mjs
 create mode 100644 node/test/verify.test.ts

diff --git a/.github/workflows/node-release.yml b/.github/workflows/node-release.yml
new file mode 100644
index 0000000..0b0c26f
--- /dev/null
+++ b/.github/workflows/node-release.yml
@@ -0,0 +1,145 @@
+name: Publish Node package to npm
+
+# Follows https://docs.npmjs.com/trusted-publishers. The npm trusted publisher must
+# reference this exact filename and the `npm` environment, or OIDC publishing is
+# rejected. Provenance is generated automatically by trusted publishing.
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+# cancel-in-progress: false — cancelling mid-publish can leave a release half done.
+concurrency:
+  group: node-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  # Source of truth for the test matrix: package.json's supportedNodeVersions.
+  # node-v* tags only — test/build/publish inherit this via `needs`.
+  versions:
+    name: node versions
+    if: startsWith(github.ref_name, 'node-v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      data: ${{ steps.set.outputs.data }}
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Generate supported versions from package.json
+        id: set
+        working-directory: node
+        run: echo "data=$(npm run --silent list-supported-versions)" >> "$GITHUB_OUTPUT"
+
+  # Full support matrix gates the release. Ubuntu only: the package is pure JavaScript
+  # and the CI workflow already covers Windows and macOS. No dependency caching in
+  # release builds, per npm's trusted-publishing guidance.
+  test:
+    name: test (Node ${{ matrix.node-version }})
+    needs: versions
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false  # report every version, not just the first failure
+      matrix:
+        node-version: ${{ fromJson(needs.versions.outputs.data).all }}
+    defaults:
+      run:
+        working-directory: node
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: ${{ matrix.node-version }}
+          package-manager-cache: false
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run the test suite
+        timeout-minutes: 10
+        run: npm test
+
+  build:
+    name: build and verify
+    needs: [versions, test]
+    if: startsWith(github.ref_name, 'node-v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: node
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: ${{ fromJson(needs.versions.outputs.data).max }}
+          package-manager-cache: false
+
+      - name: Install dependencies
+        run: npm ci
+
+      # Tag must match package.json's version, `private` must be gone, CHANGELOG must
+      # have an entry, and repository.url must be set (provenance verifies it).
+      - name: Verify the tag matches the packaged version and the package is publishable
+        run: npm run --silent verify -- "$GITHUB_REF_NAME"
+
+      - name: Build and validate the package contents
+        timeout-minutes: 5
+        run: |
+          npm run build
+          npm pack --dry-run
+
+  publish:
+    name: publish
+    needs: [versions, build]
+    if: startsWith(github.ref_name, 'node-v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    # Must match the environment name on the npm trusted publisher; carries the
+    # required-reviewer gate so a run alone cannot publish.
+    environment: npm
+    permissions:
+      # Job permissions REPLACE the top-level block, so restate contents: read.
+      contents: read
+      id-token: write  # OIDC token for npm trusted publishing
+    defaults:
+      run:
+        working-directory: node
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: ${{ fromJson(needs.versions.outputs.data).max }}
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+
+      # Trusted publishing needs npm >= 11.5.1; the newest supported Node bundles a
+      # newer one, so assert rather than install npm from the registry at publish time.
+      - name: Verify again on the publishing runner, including the npm version
+        run: npm run --silent verify -- "$GITHUB_REF_NAME" --require-npm 11.5.1
+
+      - name: Install dependencies and build
+        run: |
+          npm ci
+          npm run build
+
+      # OIDC: no token, no --provenance flag; publishConfig.access is public.
+      - name: Publish to npm
+        run: npm publish
+
+      - name: Smoke-test the published package
+        run: npm run --silent smoke -- "${GITHUB_REF_NAME#node-v}"
diff --git a/node/package.json b/node/package.json
index 0fa62ba..60a3d70 100644
--- a/node/package.json
+++ b/node/package.json
@@ -2,6 +2,13 @@
   "name": "@aws/developer-toolkit-elasticache",
   "version": "0.1.0-dev.0",
   "description": "Developer toolkit for Amazon ElastiCache",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aws/developer-toolkit-elasticache.git",
+    "directory": "node"
+  },
+  "homepage": "https://github.com/aws/developer-toolkit-elasticache/tree/main/node#readme",
+  "bugs": "https://github.com/aws/developer-toolkit-elasticache/issues",
   "type": "module",
   "private": true,
   "license": "Apache-2.0",
@@ -19,6 +26,9 @@
     "NOTICE",
     "README.md"
   ],
+  "publishConfig": {
+    "access": "public"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -35,6 +45,8 @@
     "format:check": "prettier --check .",
     "lint": "eslint .",
     "list-supported-versions": "node scripts/list-supported-versions.mjs",
+    "verify": "node scripts/verify.mjs",
+    "smoke": "node scripts/smoke.mjs",
     "package:check": "npm run clean && npm run build && npm pack --dry-run",
     "test": "npm run build && npm run build:test && node --test dist-test/test/*.test.js",
     "typecheck": "tsc -p tsconfig.json --noEmit"
diff --git a/node/scripts/smoke.mjs b/node/scripts/smoke.mjs
new file mode 100644
index 0000000..5e3340f
--- /dev/null
+++ b/node/scripts/smoke.mjs
@@ -0,0 +1,95 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Post-publish smoke test, run by node-release.yml after npm publish:
+//
+//   node scripts/smoke.mjs [VERSION]
+//
+// Installs the just-published version from the npm registry into a temporary project
+// (retrying while the registry catches up), imports it, and checks that the public API
+// is exported and that the installed version is the one that was released.
+
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { argv, env, execPath, exit, platform, stdout } from "node:process";
+import { setTimeout as sleep } from "node:timers/promises";
+
+const PACKAGE_NAME = "@aws/developer-toolkit-elasticache";
+const TAG_PREFIX = "node-v";
+const ATTEMPTS = 5;
+const RETRY_DELAY_MS = 15_000;
+const EXPECTED_EXPORTS = [
+  "ConfigurationError",
+  "ElastiCacheIAMAuthTokenManager",
+  "ElastiCacheIAMAuthTokenProvider",
+  "InvalidParameterError",
+  "TokenRefreshError",
+  "ToolkitInputError",
+  "generateIamAuthToken",
+];
+
+function fail(message) {
+  stdout.write(`::error::${message}\n`);
+  exit(1);
+}
+
+const version = argv[2] || (env.GITHUB_REF_NAME ?? "").replace(TAG_PREFIX, "");
+if (!version) {
+  fail("No version given and none could be derived from GITHUB_REF_NAME.");
+}
+
+const npm = platform === "win32" ? "npm.cmd" : "npm";
+const project = mkdtempSync(join(tmpdir(), "elasticache-smoke-"));
+try {
+  writeFileSync(join(project, "package.json"), JSON.stringify({ type: "module" }));
+  const spec = `${PACKAGE_NAME}@${version}`;
+
+  let installed = false;
+  for (let attempt = 1; attempt <= ATTEMPTS && !installed; attempt++) {
+    const result = spawnSync(
+      npm,
+      ["install", spec, "--no-audit", "--no-fund", "--ignore-scripts"],
+      { cwd: project, encoding: "utf8", shell: platform === "win32" },
+    );
+    installed = result.status === 0;
+    if (!installed && attempt < ATTEMPTS) {
+      stdout.write(
+        `install attempt ${attempt} failed (registry may lag the upload); ` +
+          `retrying in ${RETRY_DELAY_MS / 1000}s\n`,
+      );
+      await sleep(RETRY_DELAY_MS);
+    }
+  }
+  if (!installed) {
+    fail(`Could not install ${spec} from the npm registry after ${ATTEMPTS} attempts.`);
+  }
+
+  // The probe runs inside the temporary project so it resolves the installed copy.
+  const probe = join(project, "probe.mjs");
+  const manifestSpecifier = JSON.stringify(`${PACKAGE_NAME}/package.json`);
+  writeFileSync(
+    probe,
+    [
+      `import * as pkg from ${JSON.stringify(PACKAGE_NAME)};`,
+      `import { createRequire } from "node:module";`,
+      `const manifest = createRequire(import.meta.url)(${manifestSpecifier});`,
+      `const missing = ${JSON.stringify(EXPECTED_EXPORTS)}.filter((name) => !(name in pkg));`,
+      `if (missing.length) throw new Error("missing exports: " + missing.join(", "));`,
+      `if (manifest.version !== ${JSON.stringify(version)})`,
+      `  throw new Error("installed " + manifest.version + ", expected " + ${JSON.stringify(version)});`,
+    ].join("\n"),
+  );
+  const check = spawnSync(execPath, [probe], { cwd: project, encoding: "utf8" });
+  if (check.status !== 0) {
+    const reason =
+      check.stderr.split("\n").find((line) => line.startsWith("Error:")) ??
+      check.stderr.trim();
+    fail(`Published package failed the import check: ${reason}`);
+  }
+} finally {
+  rmSync(project, { recursive: true, force: true });
+}
+
+stdout.write(`Smoke test passed for ${PACKAGE_NAME}@${version}.\n`);
diff --git a/node/scripts/verify.mjs b/node/scripts/verify.mjs
new file mode 100644
index 0000000..1a1c3fb
--- /dev/null
+++ b/node/scripts/verify.mjs
@@ -0,0 +1,93 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Release gate, run by node-release.yml before anything is built or published:
+//
+//   node scripts/verify.mjs [TAG] [--require-npm <version>]
+//
+// Checks that the release tag matches package.json's version, that the package is no
+// longer marked private (the publish guard), that CHANGELOG.md has an entry for the
+// version, and that package.json declares the repository (npm provenance requires it).
+// With --require-npm, also checks the local npm is at least that version, which the
+// publish job needs for trusted publishing. Prints a GitHub Actions error annotation
+// and exits non-zero on the first failure.
+
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { argv, env, exit, platform, stdout } from "node:process";
+import { URL } from "node:url";
+
+const TAG_PREFIX = "node-v";
+const EXPECTED_REPOSITORY = "https://github.com/aws/developer-toolkit-elasticache";
+
+function fail(message) {
+  stdout.write(`::error::${message}\n`);
+  exit(1);
+}
+
+/** True when dotted version `a` is older than `b`. */
+function olderThan(a, b) {
+  const [left, right] = [a, b].map((value) => value.split(".").map(Number));
+  for (let i = 0; i < Math.max(left.length, right.length); i++) {
+    const [l, r] = [left[i] ?? 0, right[i] ?? 0];
+    if (l !== r) {
+      return l < r;
+    }
+  }
+  return false;
+}
+
+const args = argv.slice(2);
+const flagIndex = args.indexOf("--require-npm");
+const requiredNpm = flagIndex === -1 ? undefined : args[flagIndex + 1];
+const positional =
+  flagIndex === -1 ? args : args.filter((_, i) => i !== flagIndex && i !== flagIndex + 1);
+const tag = positional[0] ?? env.GITHUB_REF_NAME ?? "";
+
+const packageJson = JSON.parse(
+  readFileSync(new URL("../package.json", import.meta.url), "utf8"),
+);
+const version = packageJson.version;
+
+if (tag !== `${TAG_PREFIX}${version}`) {
+  fail(
+    `Release tag does not match the version in package.json (${version}). ` +
+      `Expected ${TAG_PREFIX}${version}. Bump the version and re-tag.`,
+  );
+}
+
+if (packageJson.private === true) {
+  fail(
+    'package.json still has "private": true. Remove it in the release commit once ' +
+      "the open-source review has cleared.",
+  );
+}
+
+const repositoryUrl =
+  typeof packageJson.repository === "string"
+    ? packageJson.repository
+    : packageJson.repository?.url;
+if (!repositoryUrl || !repositoryUrl.includes(EXPECTED_REPOSITORY)) {
+  fail(
+    `package.json repository.url must point at ${EXPECTED_REPOSITORY}; ` +
+      "npm provenance verifies it against the publishing repository.",
+  );
+}
+
+const changelog = readFileSync(new URL("../CHANGELOG.md", import.meta.url), "utf8");
+if (!changelog.includes(`## [${version}]`)) {
+  fail(`CHANGELOG.md has no "## [${version}]" entry. Add one in the release commit.`);
+}
+
+if (requiredNpm !== undefined) {
+  const npm = platform === "win32" ? "npm.cmd" : "npm";
+  const installed = execFileSync(npm, ["--version"], { encoding: "utf8" }).trim();
+  if (olderThan(installed, requiredNpm)) {
+    fail(
+      `npm ${installed} is older than ${requiredNpm}, the minimum for trusted ` +
+        "publishing. Use a Node.js release that bundles a newer npm.",
+    );
+  }
+}
+
+stdout.write(`Publishing version ${version}.\n`);
diff --git a/node/test/verify.test.ts b/node/test/verify.test.ts
new file mode 100644
index 0000000..a3c3c28
--- /dev/null
+++ b/node/test/verify.test.ts
@@ -0,0 +1,136 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { copyFileSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { test } from "node:test";
+
+const PACKAGE_ROOT = resolve(fileURLToPath(new URL("../..", import.meta.url)));
+const SCRIPT_PATH = join(PACKAGE_ROOT, "scripts", "verify.mjs");
+
+const RELEASABLE = {
+  name: "@aws/developer-toolkit-elasticache",
+  version: "1.2.3",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/aws/developer-toolkit-elasticache.git",
+  },
+};
+const CHANGELOG_WITH_ENTRY = "# Changelog\n\n## [1.2.3] - 2026-01-01\n\n- Something.\n";
+
+function runVerify(
+  args: string[],
+  packageJson: Record<string, unknown>,
+  changelog = CHANGELOG_WITH_ENTRY,
+) {
+  const temporaryRoot = mkdtempSync(join(tmpdir(), "elasticache-node-verify-"));
+  const scriptsDirectory = join(temporaryRoot, "scripts");
+  const temporaryScript = join(scriptsDirectory, "verify.mjs");
+
+  try {
+    mkdirSync(scriptsDirectory);
+    copyFileSync(SCRIPT_PATH, temporaryScript);
+    writeFileSync(join(temporaryRoot, "package.json"), JSON.stringify(packageJson));
+    writeFileSync(join(temporaryRoot, "CHANGELOG.md"), changelog);
+    return spawnSync(process.execPath, [temporaryScript, ...args], {
+      encoding: "utf8",
+      env: { ...process.env, GITHUB_REF_NAME: "" },
+    });
+  } finally {
+    rmSync(temporaryRoot, { recursive: true, force: true });
+  }
+}
+
+test("accepts a matching tag on a publishable package", () => {
+  const result = runVerify(["node-v1.2.3"], RELEASABLE);
+
+  assert.equal(result.status, 0, result.stdout + result.stderr);
+  assert.match(result.stdout, /Publishing version 1\.2\.3\./);
+});
+
+test("reads the tag from GITHUB_REF_NAME when no argument is given", () => {
+  const temporaryRoot = mkdtempSync(join(tmpdir(), "elasticache-node-verify-"));
+  try {
+    mkdirSync(join(temporaryRoot, "scripts"));
+    copyFileSync(SCRIPT_PATH, join(temporaryRoot, "scripts", "verify.mjs"));
+    writeFileSync(join(temporaryRoot, "package.json"), JSON.stringify(RELEASABLE));
+    writeFileSync(join(temporaryRoot, "CHANGELOG.md"), CHANGELOG_WITH_ENTRY);
+    const result = spawnSync(
+      process.execPath,
+      [join(temporaryRoot, "scripts", "verify.mjs")],
+      {
+        encoding: "utf8",
+        env: { ...process.env, GITHUB_REF_NAME: "node-v1.2.3" },
+      },
+    );
+    assert.equal(result.status, 0, result.stdout + result.stderr);
+  } finally {
+    rmSync(temporaryRoot, { recursive: true, force: true });
+  }
+});
+
+const rejectedCases: {
+  name: string;
+  args: string[];
+  packageJson: Record<string, unknown>;
+  changelog?: string;
+  expectedError: RegExp;
+}[] = [
+  {
+    name: "rejects a tag that does not match the version",
+    args: ["node-v1.2.4"],
+    packageJson: RELEASABLE,
+    expectedError: /does not match the version in package\.json \(1\.2\.3\)/,
+  },
+  {
+    name: "rejects a tag without the node-v prefix",
+    args: ["v1.2.3"],
+    packageJson: RELEASABLE,
+    expectedError: /Expected node-v1\.2\.3/,
+  },
+  {
+    name: "rejects a package still marked private",
+    args: ["node-v1.2.3"],
+    packageJson: { ...RELEASABLE, private: true },
+    expectedError: /"private": true/,
+  },
+  {
+    name: "rejects a missing repository url",
+    args: ["node-v1.2.3"],
+    packageJson: { name: RELEASABLE.name, version: RELEASABLE.version },
+    expectedError: /repository\.url must point at/,
+  },
+  {
+    name: "rejects a changelog without an entry for the version",
+    args: ["node-v1.2.3"],
+    packageJson: RELEASABLE,
+    changelog: "# Changelog\n\n## [Unreleased]\n\n- Something.\n",
+    expectedError: /CHANGELOG\.md has no "## \[1\.2\.3\]" entry/,
+  },
+  {
+    name: "rejects an npm older than the required version",
+    args: ["node-v1.2.3", "--require-npm", "999.0.0"],
+    packageJson: RELEASABLE,
+    expectedError: /older than 999\.0\.0/,
+  },
+];
+
+for (const testCase of rejectedCases) {
+  test(testCase.name, () => {
+    const result = runVerify(testCase.args, testCase.packageJson, testCase.changelog);
+
+    assert.notEqual(result.status, 0);
+    assert.match(result.stdout, /^::error::/m);
+    assert.match(result.stdout, testCase.expectedError);
+  });
+}
+
+test("accepts an npm at or above the required version", () => {
+  const result = runVerify(["node-v1.2.3", "--require-npm", "1.0.0"], RELEASABLE);
+
+  assert.equal(result.status, 0, result.stdout + result.stderr);
+});

From 82089a746b8ab643a62d6a2b7059362b855fb56c Mon Sep 17 00:00:00 2001
From: mwaisaida-13 <aidams@amazon.com>
Date: Tue, 22 Sep 2026 16:14:16 +0100
Subject: [PATCH 2/7] fix(node): spawn npm through a shell on Windows in
 verify.mjs

Node refuses to spawn .cmd shims directly (spawnSync npm.cmd EINVAL), which
failed the --require-npm check on the Windows CI runners.
---
 node/scripts/verify.mjs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/node/scripts/verify.mjs b/node/scripts/verify.mjs
index 1a1c3fb..141c100 100644
--- a/node/scripts/verify.mjs
+++ b/node/scripts/verify.mjs
@@ -80,8 +80,12 @@ if (!changelog.includes(`## [${version}]`)) {
 }
 
 if (requiredNpm !== undefined) {
+  // Windows: npm is a .cmd shim, which Node only spawns through a shell.
   const npm = platform === "win32" ? "npm.cmd" : "npm";
-  const installed = execFileSync(npm, ["--version"], { encoding: "utf8" }).trim();
+  const installed = execFileSync(npm, ["--version"], {
+    encoding: "utf8",
+    shell: platform === "win32",
+  }).trim();
   if (olderThan(installed, requiredNpm)) {
     fail(
       `npm ${installed} is older than ${requiredNpm}, the minimum for trusted ` +

From 09585a13d24fa70b020c0974877722d13bdc805e Mon Sep 17 00:00:00 2001
From: mwaisaida-13 <aidams@amazon.com>
Date: Thu, 24 Sep 2026 20:26:40 +0100
Subject: [PATCH 3/7] ci(node): move the post-publish smoke test into
 scripts/node_dev.py

Same shape as scripts/java_dev.py: a small stdlib-only Python script for the
step npm has no command for. The release gate stays in node/scripts/verify.mjs
(npm run verify, with its tests); everything else is plain npm in the workflow.

- smoke VERSION installs the exact published version into a temporary project
  and checks the public exports. It retries 20 times, 40s apart (about 13
  minutes), with a fresh npm cache and --prefer-online each time, logging
  'install attempt X/20 failed (registry may lag the upload)': the registry has
  taken around 8 minutes to serve a newly published tarball.
- Replaces node/scripts/smoke.mjs.
- The publish job gains a repository_owner guard, so a fork can never publish,
  and the build job packs into node/pack/ for the publish job.
---
 .github/workflows/node-release.yml | 69 ++++++++++++----------
 node/.gitignore                    |  1 +
 node/package.json                  |  1 -
 node/scripts/smoke.mjs             | 95 ------------------------------
 scripts/node_dev.py                | 92 +++++++++++++++++++++++++++++
 5 files changed, 130 insertions(+), 128 deletions(-)
 delete mode 100644 node/scripts/smoke.mjs
 create mode 100644 scripts/node_dev.py

diff --git a/.github/workflows/node-release.yml b/.github/workflows/node-release.yml
index 0b0c26f..22e9fe6 100644
--- a/.github/workflows/node-release.yml
+++ b/.github/workflows/node-release.yml
@@ -1,8 +1,7 @@
 name: Publish Node package to npm
 
-# Follows https://docs.npmjs.com/trusted-publishers. The npm trusted publisher must
-# reference this exact filename and the `npm` environment, or OIDC publishing is
-# rejected. Provenance is generated automatically by trusted publishing.
+# The npm trusted publisher must reference this exact filename and the `npm`
+# environment (https://docs.npmjs.com/trusted-publishers).
 
 on:
   release:
@@ -37,7 +36,7 @@ jobs:
 
   # Full support matrix gates the release. Ubuntu only: the package is pure JavaScript
   # and the CI workflow already covers Windows and macOS. No dependency caching in
-  # release builds, per npm's trusted-publishing guidance.
+  # release jobs, per npm's trusted-publishing guidance.
   test:
     name: test (Node ${{ matrix.node-version }})
     needs: versions
@@ -60,12 +59,11 @@ jobs:
           node-version: ${{ matrix.node-version }}
           package-manager-cache: false
 
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run the test suite
+      - name: Install and run the test suite
         timeout-minutes: 10
-        run: npm test
+        run: |
+          npm ci
+          npm test
 
   build:
     name: build and verify
@@ -73,9 +71,6 @@ jobs:
     if: startsWith(github.ref_name, 'node-v')
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    defaults:
-      run:
-        working-directory: node
     steps:
       - name: Check out the repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -86,26 +81,35 @@ jobs:
           node-version: ${{ fromJson(needs.versions.outputs.data).max }}
           package-manager-cache: false
 
-      - name: Install dependencies
-        run: npm ci
-
       # Tag must match package.json's version, `private` must be gone, CHANGELOG must
       # have an entry, and repository.url must be set (provenance verifies it).
       - name: Verify the tag matches the packaged version and the package is publishable
+        working-directory: node
         run: npm run --silent verify -- "$GITHUB_REF_NAME"
 
-      - name: Build and validate the package contents
+      - name: Build and pack the tarball
+        working-directory: node
         timeout-minutes: 5
         run: |
+          npm ci
           npm run build
-          npm pack --dry-run
+          mkdir pack
+          npm pack --pack-destination pack
+
+      - name: Save the tarball for the publish job
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: node-dist
+          path: node/pack/
+          if-no-files-found: error  # an empty artifact silently breaks the publish job
 
   publish:
     name: publish
     needs: [versions, build]
-    if: startsWith(github.ref_name, 'node-v')
+    # A fork that copies this workflow and its tags can never publish.
+    if: startsWith(github.ref_name, 'node-v') && github.repository_owner == 'aws'
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 20
     # Must match the environment name on the npm trusted publisher; carries the
     # required-reviewer gate so a run alone cannot publish.
     environment: npm
@@ -113,13 +117,12 @@ jobs:
       # Job permissions REPLACE the top-level block, so restate contents: read.
       contents: read
       id-token: write  # OIDC token for npm trusted publishing
-    defaults:
-      run:
-        working-directory: node
     steps:
       - name: Check out the repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # No NODE_AUTH_TOKEN: auth comes from the OIDC token, which npm >= 11.5.1 uses
+      # automatically.
       - name: Set up Node.js
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
@@ -127,19 +130,21 @@ jobs:
           registry-url: https://registry.npmjs.org
           package-manager-cache: false
 
-      # Trusted publishing needs npm >= 11.5.1; the newest supported Node bundles a
-      # newer one, so assert rather than install npm from the registry at publish time.
+      # The newest supported Node bundles npm >= 11.5.1; assert it rather than install
+      # npm from the registry at publish time.
       - name: Verify again on the publishing runner, including the npm version
+        working-directory: node
         run: npm run --silent verify -- "$GITHUB_REF_NAME" --require-npm 11.5.1
 
-      - name: Install dependencies and build
-        run: |
-          npm ci
-          npm run build
+      - name: Retrieve the tarball from the build job
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: node-dist
+          path: node/pack/
 
-      # OIDC: no token, no --provenance flag; publishConfig.access is public.
-      - name: Publish to npm
-        run: npm publish
+      - name: Publish to npm with provenance
+        run: npm publish node/pack/*.tgz --provenance --access public
 
+      # Retries for ~13 minutes (20 x 40s): the registry lags behind a publish.
       - name: Smoke-test the published package
-        run: npm run --silent smoke -- "${GITHUB_REF_NAME#node-v}"
+        run: python3 scripts/node_dev.py smoke "${GITHUB_REF_NAME#node-v}"
diff --git a/node/.gitignore b/node/.gitignore
index 4abc033..cc1b485 100644
--- a/node/.gitignore
+++ b/node/.gitignore
@@ -5,6 +5,7 @@ node_modules/
 
 # npm
 *.tgz
+pack/
 npm-debug.log*
 
 # Test / coverage output
diff --git a/node/package.json b/node/package.json
index 60a3d70..0b78ec6 100644
--- a/node/package.json
+++ b/node/package.json
@@ -46,7 +46,6 @@
     "lint": "eslint .",
     "list-supported-versions": "node scripts/list-supported-versions.mjs",
     "verify": "node scripts/verify.mjs",
-    "smoke": "node scripts/smoke.mjs",
     "package:check": "npm run clean && npm run build && npm pack --dry-run",
     "test": "npm run build && npm run build:test && node --test dist-test/test/*.test.js",
     "typecheck": "tsc -p tsconfig.json --noEmit"
diff --git a/node/scripts/smoke.mjs b/node/scripts/smoke.mjs
deleted file mode 100644
index 5e3340f..0000000
--- a/node/scripts/smoke.mjs
+++ /dev/null
@@ -1,95 +0,0 @@
-// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Post-publish smoke test, run by node-release.yml after npm publish:
-//
-//   node scripts/smoke.mjs [VERSION]
-//
-// Installs the just-published version from the npm registry into a temporary project
-// (retrying while the registry catches up), imports it, and checks that the public API
-// is exported and that the installed version is the one that was released.
-
-import { spawnSync } from "node:child_process";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { argv, env, execPath, exit, platform, stdout } from "node:process";
-import { setTimeout as sleep } from "node:timers/promises";
-
-const PACKAGE_NAME = "@aws/developer-toolkit-elasticache";
-const TAG_PREFIX = "node-v";
-const ATTEMPTS = 5;
-const RETRY_DELAY_MS = 15_000;
-const EXPECTED_EXPORTS = [
-  "ConfigurationError",
-  "ElastiCacheIAMAuthTokenManager",
-  "ElastiCacheIAMAuthTokenProvider",
-  "InvalidParameterError",
-  "TokenRefreshError",
-  "ToolkitInputError",
-  "generateIamAuthToken",
-];
-
-function fail(message) {
-  stdout.write(`::error::${message}\n`);
-  exit(1);
-}
-
-const version = argv[2] || (env.GITHUB_REF_NAME ?? "").replace(TAG_PREFIX, "");
-if (!version) {
-  fail("No version given and none could be derived from GITHUB_REF_NAME.");
-}
-
-const npm = platform === "win32" ? "npm.cmd" : "npm";
-const project = mkdtempSync(join(tmpdir(), "elasticache-smoke-"));
-try {
-  writeFileSync(join(project, "package.json"), JSON.stringify({ type: "module" }));
-  const spec = `${PACKAGE_NAME}@${version}`;
-
-  let installed = false;
-  for (let attempt = 1; attempt <= ATTEMPTS && !installed; attempt++) {
-    const result = spawnSync(
-      npm,
-      ["install", spec, "--no-audit", "--no-fund", "--ignore-scripts"],
-      { cwd: project, encoding: "utf8", shell: platform === "win32" },
-    );
-    installed = result.status === 0;
-    if (!installed && attempt < ATTEMPTS) {
-      stdout.write(
-        `install attempt ${attempt} failed (registry may lag the upload); ` +
-          `retrying in ${RETRY_DELAY_MS / 1000}s\n`,
-      );
-      await sleep(RETRY_DELAY_MS);
-    }
-  }
-  if (!installed) {
-    fail(`Could not install ${spec} from the npm registry after ${ATTEMPTS} attempts.`);
-  }
-
-  // The probe runs inside the temporary project so it resolves the installed copy.
-  const probe = join(project, "probe.mjs");
-  const manifestSpecifier = JSON.stringify(`${PACKAGE_NAME}/package.json`);
-  writeFileSync(
-    probe,
-    [
-      `import * as pkg from ${JSON.stringify(PACKAGE_NAME)};`,
-      `import { createRequire } from "node:module";`,
-      `const manifest = createRequire(import.meta.url)(${manifestSpecifier});`,
-      `const missing = ${JSON.stringify(EXPECTED_EXPORTS)}.filter((name) => !(name in pkg));`,
-      `if (missing.length) throw new Error("missing exports: " + missing.join(", "));`,
-      `if (manifest.version !== ${JSON.stringify(version)})`,
-      `  throw new Error("installed " + manifest.version + ", expected " + ${JSON.stringify(version)});`,
-    ].join("\n"),
-  );
-  const check = spawnSync(execPath, [probe], { cwd: project, encoding: "utf8" });
-  if (check.status !== 0) {
-    const reason =
-      check.stderr.split("\n").find((line) => line.startsWith("Error:")) ??
-      check.stderr.trim();
-    fail(`Published package failed the import check: ${reason}`);
-  }
-} finally {
-  rmSync(project, { recursive: true, force: true });
-}
-
-stdout.write(`Smoke test passed for ${PACKAGE_NAME}@${version}.\n`);
diff --git a/scripts/node_dev.py b/scripts/node_dev.py
new file mode 100644
index 0000000..e4e1a43
--- /dev/null
+++ b/scripts/node_dev.py
@@ -0,0 +1,92 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+# ruff: noqa: INP001, T201, S603, S607  # a CLI script that prints and runs npm/node
+
+"""Node release smoke test, called by node-release.yml after publishing.
+
+python3 scripts/node_dev.py smoke VERSION
+"""
+
+import argparse
+import json
+import subprocess
+import tempfile
+import time
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+NODE_DIR = ROOT / "node"
+EXPORTS = [
+    "ConfigurationError",
+    "ElastiCacheIAMAuthTokenManager",
+    "ElastiCacheIAMAuthTokenProvider",
+    "InvalidParameterError",
+    "TokenRefreshError",
+    "ToolkitInputError",
+    "generateIamAuthToken",
+]
+# The registry's package listing has lagged 5+ minutes behind a publish.
+INSTALL_ATTEMPTS = 20
+INSTALL_RETRY_SECONDS = 40
+
+
+def fail(message: str) -> None:
+    raise SystemExit(f"::error::{message}")
+
+
+def smoke(version: str) -> None:
+    name = json.loads((NODE_DIR / "package.json").read_text())["name"]
+    spec = f"{name}@{version}"
+    with tempfile.TemporaryDirectory() as project:
+        Path(project, "package.json").write_text('{"private": true, "type": "module"}')
+        for attempt in range(1, INSTALL_ATTEMPTS + 1):
+            # Exact version, fresh cache, --prefer-online: a cached "not found" must
+            # not outlive the registry catching up.
+            with tempfile.TemporaryDirectory() as cache:
+                command = ["npm", "install", spec, "--no-audit", "--no-fund"]
+                command += ["--ignore-scripts", "--prefer-online", "--cache", cache]
+                result = subprocess.run(command, cwd=project, check=False)
+            if result.returncode == 0:
+                break
+            if attempt == INSTALL_ATTEMPTS:
+                fail(f"Could not install {spec} after {INSTALL_ATTEMPTS} attempts.")
+            print(
+                f"install attempt {attempt}/{INSTALL_ATTEMPTS} failed (registry may lag "
+                f"the upload); retrying in {INSTALL_RETRY_SECONDS}s"
+            )
+            time.sleep(INSTALL_RETRY_SECONDS)
+
+        manifest = Path(project, "node_modules", *name.split("/"), "package.json")
+        installed = json.loads(manifest.read_text())["version"]
+        if installed != version:
+            fail(f"Installed {name}@{installed}, expected {version}.")
+        probe = (
+            f"import * as pkg from {json.dumps(name)};"
+            f"const missing = {json.dumps(EXPORTS)}.filter((n) => !(n in pkg));"
+            "if (missing.length) { console.error(missing.join(', ')); process.exit(1); }"
+        )
+        check = subprocess.run(
+            ["node", "--input-type=module", "-e", probe],
+            cwd=project,
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        if check.returncode != 0:
+            fail(f"Published package is missing exports: {check.stderr.strip()}")
+    print(f"Smoke test passed for {spec}.")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    commands = parser.add_subparsers(dest="command", required=True)
+    smoke_parser = commands.add_parser("smoke")
+    smoke_parser.add_argument("version")
+    args = parser.parse_args()
+
+    if args.command == "smoke":
+        smoke(args.version)
+
+
+if __name__ == "__main__":
+    main()

From a005341c5c9c5cf2419a1af0684b9971fa40a138 Mon Sep 17 00:00:00 2001
From: mwaisaida-13 <aidams@amazon.com>
Date: Thu, 24 Sep 2026 20:43:43 +0100
Subject: [PATCH 4/7] ci(python): run Python CI only when its own runner
 changes

python.yml watched scripts/**, so a change to another language's runner
(scripts/node_dev.py) also ran the Python matrix. Watch scripts/python_dev.py,
like java.yml watches scripts/java_dev.py.
---
 .github/workflows/python.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index 7f94871..cc52543 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -7,12 +7,12 @@ on:
     branches: [main]
     paths:
       - "python/**"
-      - "scripts/**"
+      - "scripts/python_dev.py"
       - ".github/workflows/python.yml"
   pull_request:
     paths:
       - "python/**"
-      - "scripts/**"
+      - "scripts/python_dev.py"
       - ".github/workflows/python.yml"
 
 jobs:

From 3fd40a32a504c78a3f19522d5c5186f0ddb3e8b9 Mon Sep 17 00:00:00 2001
From: mwaisaida-13 <aidams@amazon.com>
Date: Thu, 24 Sep 2026 23:39:10 +0100
Subject: [PATCH 5/7] ci(node): tighten the release gate and support release
 candidates

verify.mjs:
- Accept X.Y.Z and X.Y.Z-rc.N only. Release candidates publish under the
  `next` dist-tag (verify writes dist_tag to GITHUB_OUTPUT and the publish
  step passes it), so `latest` keeps pointing at the last full release. Any
  other prerelease suffix is rejected in the gate; npm itself refuses a
  prerelease without an explicit --tag, which would only fail at the upload.
- Reject --require-npm without a value; it silently skipped the npm check.
- Reject non-numeric version parts instead of comparing NaN, which passed
  silently.

Tests: runVerify takes an env parameter; cases for each of the above.
---
 .github/workflows/node-release.yml |   4 +-
 node/scripts/verify.mjs            |  32 ++++++++-
 node/test/verify.test.ts           | 102 +++++++++++++++++++++++------
 3 files changed, 113 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/node-release.yml b/.github/workflows/node-release.yml
index 22e9fe6..dcf6106 100644
--- a/.github/workflows/node-release.yml
+++ b/.github/workflows/node-release.yml
@@ -132,7 +132,9 @@ jobs:
 
       # The newest supported Node bundles npm >= 11.5.1; assert it rather than install
       # npm from the registry at publish time.
+      # Also decides the dist-tag: `latest` for releases, `next` for X.Y.Z-rc.N.
       - name: Verify again on the publishing runner, including the npm version
+        id: verify
         working-directory: node
         run: npm run --silent verify -- "$GITHUB_REF_NAME" --require-npm 11.5.1
 
@@ -143,7 +145,7 @@ jobs:
           path: node/pack/
 
       - name: Publish to npm with provenance
-        run: npm publish node/pack/*.tgz --provenance --access public
+        run: npm publish node/pack/*.tgz --provenance --access public --tag "${{ steps.verify.outputs.dist_tag }}"
 
       # Retries for ~13 minutes (20 x 40s): the registry lags behind a publish.
       - name: Smoke-test the published package
diff --git a/node/scripts/verify.mjs b/node/scripts/verify.mjs
index 141c100..def8241 100644
--- a/node/scripts/verify.mjs
+++ b/node/scripts/verify.mjs
@@ -13,7 +13,7 @@
 // and exits non-zero on the first failure.
 
 import { execFileSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { appendFileSync, readFileSync } from "node:fs";
 import { argv, env, exit, platform, stdout } from "node:process";
 import { URL } from "node:url";
 
@@ -25,9 +25,20 @@ function fail(message) {
   exit(1);
 }
 
+function versionParts(value, what) {
+  const parts = value.split(".").map(Number);
+  if (parts.some((part) => !Number.isInteger(part) || part < 0)) {
+    fail(`${what} is not a dotted numeric version: ${value}`);
+  }
+  return parts;
+}
+
 /** True when dotted version `a` is older than `b`. */
 function olderThan(a, b) {
-  const [left, right] = [a, b].map((value) => value.split(".").map(Number));
+  const [left, right] = [
+    versionParts(a, "the installed npm version"),
+    versionParts(b, "--require-npm"),
+  ];
   for (let i = 0; i < Math.max(left.length, right.length); i++) {
     const [l, r] = [left[i] ?? 0, right[i] ?? 0];
     if (l !== r) {
@@ -40,6 +51,9 @@ function olderThan(a, b) {
 const args = argv.slice(2);
 const flagIndex = args.indexOf("--require-npm");
 const requiredNpm = flagIndex === -1 ? undefined : args[flagIndex + 1];
+if (flagIndex !== -1 && (requiredNpm === undefined || requiredNpm.startsWith("-"))) {
+  fail("--require-npm needs a version, for example --require-npm 11.5.1.");
+}
 const positional =
   flagIndex === -1 ? args : args.filter((_, i) => i !== flagIndex && i !== flagIndex + 1);
 const tag = positional[0] ?? env.GITHUB_REF_NAME ?? "";
@@ -63,6 +77,15 @@ if (packageJson.private === true) {
   );
 }
 
+const prerelease = version.split("-")[1];
+if (prerelease !== undefined && !/^rc\.\d+$/.test(prerelease)) {
+  fail(
+    `Version ${version} has prerelease suffix "-${prerelease}". Only release ` +
+      "versions (X.Y.Z) and release candidates (X.Y.Z-rc.N) are published.",
+  );
+}
+const distTag = prerelease === undefined ? "latest" : "next";
+
 const repositoryUrl =
   typeof packageJson.repository === "string"
     ? packageJson.repository
@@ -94,4 +117,7 @@ if (requiredNpm !== undefined) {
   }
 }
 
-stdout.write(`Publishing version ${version}.\n`);
+if (env.GITHUB_OUTPUT) {
+  appendFileSync(env.GITHUB_OUTPUT, `dist_tag=${distTag}\n`);
+}
+stdout.write(`Publishing version ${version} with dist-tag ${distTag}.\n`);
diff --git a/node/test/verify.test.ts b/node/test/verify.test.ts
index a3c3c28..a71842f 100644
--- a/node/test/verify.test.ts
+++ b/node/test/verify.test.ts
@@ -3,7 +3,14 @@
 
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { copyFileSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import {
+  copyFileSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -26,6 +33,7 @@ function runVerify(
   args: string[],
   packageJson: Record<string, unknown>,
   changelog = CHANGELOG_WITH_ENTRY,
+  env: Record<string, string> = { GITHUB_REF_NAME: "" },
 ) {
   const temporaryRoot = mkdtempSync(join(tmpdir(), "elasticache-node-verify-"));
   const scriptsDirectory = join(temporaryRoot, "scripts");
@@ -38,7 +46,7 @@ function runVerify(
     writeFileSync(join(temporaryRoot, "CHANGELOG.md"), changelog);
     return spawnSync(process.execPath, [temporaryScript, ...args], {
       encoding: "utf8",
-      env: { ...process.env, GITHUB_REF_NAME: "" },
+      env: { ...process.env, ...env },
     });
   } finally {
     rmSync(temporaryRoot, { recursive: true, force: true });
@@ -49,28 +57,15 @@ test("accepts a matching tag on a publishable package", () => {
   const result = runVerify(["node-v1.2.3"], RELEASABLE);
 
   assert.equal(result.status, 0, result.stdout + result.stderr);
-  assert.match(result.stdout, /Publishing version 1\.2\.3\./);
+  assert.match(result.stdout, /Publishing version 1\.2\.3 with dist-tag latest\./);
 });
 
 test("reads the tag from GITHUB_REF_NAME when no argument is given", () => {
-  const temporaryRoot = mkdtempSync(join(tmpdir(), "elasticache-node-verify-"));
-  try {
-    mkdirSync(join(temporaryRoot, "scripts"));
-    copyFileSync(SCRIPT_PATH, join(temporaryRoot, "scripts", "verify.mjs"));
-    writeFileSync(join(temporaryRoot, "package.json"), JSON.stringify(RELEASABLE));
-    writeFileSync(join(temporaryRoot, "CHANGELOG.md"), CHANGELOG_WITH_ENTRY);
-    const result = spawnSync(
-      process.execPath,
-      [join(temporaryRoot, "scripts", "verify.mjs")],
-      {
-        encoding: "utf8",
-        env: { ...process.env, GITHUB_REF_NAME: "node-v1.2.3" },
-      },
-    );
-    assert.equal(result.status, 0, result.stdout + result.stderr);
-  } finally {
-    rmSync(temporaryRoot, { recursive: true, force: true });
-  }
+  const result = runVerify([], RELEASABLE, CHANGELOG_WITH_ENTRY, {
+    GITHUB_REF_NAME: "node-v1.2.3",
+  });
+
+  assert.equal(result.status, 0, result.stdout + result.stderr);
 });
 
 const rejectedCases: {
@@ -111,6 +106,38 @@ const rejectedCases: {
     changelog: "# Changelog\n\n## [Unreleased]\n\n- Something.\n",
     expectedError: /CHANGELOG\.md has no "## \[1\.2\.3\]" entry/,
   },
+  {
+    name: "rejects a prerelease that is not a release candidate",
+    args: ["node-v1.2.3-beta.1"],
+    packageJson: { ...RELEASABLE, version: "1.2.3-beta.1" },
+    changelog: "# Changelog\n\n## [1.2.3-beta.1] - 2026-01-01\n\n- Something.\n",
+    expectedError: /Only release versions .* and release candidates/,
+  },
+  {
+    name: "rejects a dev version",
+    args: ["node-v0.1.0-dev.0"],
+    packageJson: { ...RELEASABLE, version: "0.1.0-dev.0" },
+    changelog: "# Changelog\n\n## [0.1.0-dev.0] - 2026-01-01\n\n- Something.\n",
+    expectedError: /prerelease suffix "-dev.0"/,
+  },
+  {
+    name: "rejects --require-npm without a value",
+    args: ["node-v1.2.3", "--require-npm"],
+    packageJson: RELEASABLE,
+    expectedError: /--require-npm needs a version/,
+  },
+  {
+    name: "rejects --require-npm followed by another flag",
+    args: ["node-v1.2.3", "--require-npm", "--whatever"],
+    packageJson: RELEASABLE,
+    expectedError: /--require-npm needs a version/,
+  },
+  {
+    name: "rejects a non-numeric --require-npm value",
+    args: ["node-v1.2.3", "--require-npm", "eleven"],
+    packageJson: RELEASABLE,
+    expectedError: /not a dotted numeric version/,
+  },
   {
     name: "rejects an npm older than the required version",
     args: ["node-v1.2.3", "--require-npm", "999.0.0"],
@@ -129,6 +156,39 @@ for (const testCase of rejectedCases) {
   });
 }
 
+const RC = { ...RELEASABLE, version: "1.2.3-rc.1" };
+const RC_CHANGELOG = "# Changelog\n\n## [1.2.3-rc.1] - 2026-01-01\n\n- Something.\n";
+
+test("publishes a release under the latest dist-tag", () => {
+  const result = runVerify(["node-v1.2.3"], RELEASABLE);
+
+  assert.equal(result.status, 0, result.stdout + result.stderr);
+  assert.match(result.stdout, /with dist-tag latest\./);
+});
+
+test("publishes a release candidate under the next dist-tag", () => {
+  const result = runVerify(["node-v1.2.3-rc.1"], RC, RC_CHANGELOG);
+
+  assert.equal(result.status, 0, result.stdout + result.stderr);
+  assert.match(result.stdout, /with dist-tag next\./);
+});
+
+test("writes the dist-tag to GITHUB_OUTPUT when set", () => {
+  const outputDirectory = mkdtempSync(join(tmpdir(), "elasticache-gh-output-"));
+  const outputFile = join(outputDirectory, "out");
+  try {
+    const result = runVerify(["node-v1.2.3-rc.1"], RC, RC_CHANGELOG, {
+      GITHUB_REF_NAME: "",
+      GITHUB_OUTPUT: outputFile,
+    });
+
+    assert.equal(result.status, 0, result.stdout + result.stderr);
+    assert.equal(readFileSync(outputFile, "utf8"), "dist_tag=next\n");
+  } finally {
+    rmSync(outputDirectory, { recursive: true, force: true });
+  }
+});
+
 test("accepts an npm at or above the required version", () => {
   const result = runVerify(["node-v1.2.3", "--require-npm", "1.0.0"], RELEASABLE);
 

From 284e3e62b83d58ae8a0afd5e01de43c173a23f6e Mon Sep 17 00:00:00 2001
From: mwaisaida-13 <aidams@amazon.com>
Date: Thu, 24 Sep 2026 23:47:17 +0100
Subject: [PATCH 6/7] ci(python): accept release candidates in the release gate

verify accepts X.Y.Z and X.Y.ZrcN (PEP 440) and rejects any other suffix
(.devN, aN, bN). pip skips pre-releases unless one is requested explicitly, so
an RC on PyPI never reaches a plain pip install and needs no separate channel.
---
 scripts/python_dev.py | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/scripts/python_dev.py b/scripts/python_dev.py
index ee6633b..e21c1c2 100755
--- a/scripts/python_dev.py
+++ b/scripts/python_dev.py
@@ -36,6 +36,8 @@
 PACKAGE = "developer-toolkit-elasticache"
 IMPORT_NAME = "developer_toolkit_elasticache"
 DO_NOT_UPLOAD = "Private :: Do Not Upload"
+# Release versions (X.Y.Z) and release candidates (X.Y.ZrcN, PEP 440).
+_PUBLISHABLE_VERSION = re.compile(r"\d+\.\d+\.\d+(rc\d+)?")
 
 
 _COMMANDS = {
@@ -150,6 +152,12 @@ def verify(args: argparse.Namespace) -> int:
             f"({pkg_version}). Bump the version and re-tag."
         )
         return 1
+    if not _PUBLISHABLE_VERSION.fullmatch(pkg_version):
+        print(
+            f"::error::Version {pkg_version} is not publishable. Only release versions "
+            "(X.Y.Z) and release candidates (X.Y.ZrcN) are published."
+        )
+        return 1
     if DO_NOT_UPLOAD in project.get("classifiers", []):
         print(
             f"::error::The '{DO_NOT_UPLOAD}' classifier is still set. Remove it in the "
@@ -160,7 +168,8 @@ def verify(args: argparse.Namespace) -> int:
     if drift:
         print(f"::error::{drift}")
         return 1
-    print(f"Publishing version {pkg_version}.")
+    kind = "release candidate" if "rc" in pkg_version else "release"
+    print(f"Publishing version {pkg_version} ({kind}).")
     return 0
 
 

From 32397e99e6a448ee375fd2b59a7b7ddfd5eaf731 Mon Sep 17 00:00:00 2001
From: mwaisaida-13 <aidams@amazon.com>
Date: Fri, 25 Sep 2026 01:05:31 +0100
Subject: [PATCH 7/7] ci: reject prerelease versions in the Node and Python
 release gates

npm refuses to publish a prerelease version without an explicit dist-tag, so
verify.mjs now fails on any version with a prerelease suffix and the publish
step no longer needs a computed --tag. The Python gate applies the same rule
(X.Y.Z only). Prereleases are never required before a release.
---
 .github/workflows/node-release.yml |  4 +--
 node/scripts/verify.mjs            | 19 ++++------
 node/test/verify.test.ts           | 56 +++++-------------------------
 scripts/python_dev.py              | 13 ++++---
 4 files changed, 22 insertions(+), 70 deletions(-)

diff --git a/.github/workflows/node-release.yml b/.github/workflows/node-release.yml
index dcf6106..22e9fe6 100644
--- a/.github/workflows/node-release.yml
+++ b/.github/workflows/node-release.yml
@@ -132,9 +132,7 @@ jobs:
 
       # The newest supported Node bundles npm >= 11.5.1; assert it rather than install
       # npm from the registry at publish time.
-      # Also decides the dist-tag: `latest` for releases, `next` for X.Y.Z-rc.N.
       - name: Verify again on the publishing runner, including the npm version
-        id: verify
         working-directory: node
         run: npm run --silent verify -- "$GITHUB_REF_NAME" --require-npm 11.5.1
 
@@ -145,7 +143,7 @@ jobs:
           path: node/pack/
 
       - name: Publish to npm with provenance
-        run: npm publish node/pack/*.tgz --provenance --access public --tag "${{ steps.verify.outputs.dist_tag }}"
+        run: npm publish node/pack/*.tgz --provenance --access public
 
       # Retries for ~13 minutes (20 x 40s): the registry lags behind a publish.
       - name: Smoke-test the published package
diff --git a/node/scripts/verify.mjs b/node/scripts/verify.mjs
index def8241..f63d3b2 100644
--- a/node/scripts/verify.mjs
+++ b/node/scripts/verify.mjs
@@ -6,14 +6,15 @@
 //   node scripts/verify.mjs [TAG] [--require-npm <version>]
 //
 // Checks that the release tag matches package.json's version, that the package is no
-// longer marked private (the publish guard), that CHANGELOG.md has an entry for the
-// version, and that package.json declares the repository (npm provenance requires it).
+// longer marked private (the publish guard), that the version is not a prerelease, that
+// CHANGELOG.md has an entry for the version, and that package.json declares the
+// repository.
 // With --require-npm, also checks the local npm is at least that version, which the
 // publish job needs for trusted publishing. Prints a GitHub Actions error annotation
 // and exits non-zero on the first failure.
 
 import { execFileSync } from "node:child_process";
-import { appendFileSync, readFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { argv, env, exit, platform, stdout } from "node:process";
 import { URL } from "node:url";
 
@@ -77,14 +78,11 @@ if (packageJson.private === true) {
   );
 }
 
-const prerelease = version.split("-")[1];
-if (prerelease !== undefined && !/^rc\.\d+$/.test(prerelease)) {
+if (version.includes("-")) {
   fail(
-    `Version ${version} has prerelease suffix "-${prerelease}". Only release ` +
-      "versions (X.Y.Z) and release candidates (X.Y.Z-rc.N) are published.",
+    `Version ${version} is a prerelease. Only release versions (X.Y.Z) are published.`,
   );
 }
-const distTag = prerelease === undefined ? "latest" : "next";
 
 const repositoryUrl =
   typeof packageJson.repository === "string"
@@ -117,7 +115,4 @@ if (requiredNpm !== undefined) {
   }
 }
 
-if (env.GITHUB_OUTPUT) {
-  appendFileSync(env.GITHUB_OUTPUT, `dist_tag=${distTag}\n`);
-}
-stdout.write(`Publishing version ${version} with dist-tag ${distTag}.\n`);
+stdout.write(`Publishing version ${version}.\n`);
diff --git a/node/test/verify.test.ts b/node/test/verify.test.ts
index a71842f..261bf2f 100644
--- a/node/test/verify.test.ts
+++ b/node/test/verify.test.ts
@@ -3,14 +3,7 @@
 
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import {
-  copyFileSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
+import { copyFileSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -57,7 +50,7 @@ test("accepts a matching tag on a publishable package", () => {
   const result = runVerify(["node-v1.2.3"], RELEASABLE);
 
   assert.equal(result.status, 0, result.stdout + result.stderr);
-  assert.match(result.stdout, /Publishing version 1\.2\.3 with dist-tag latest\./);
+  assert.match(result.stdout, /Publishing version 1\.2\.3\./);
 });
 
 test("reads the tag from GITHUB_REF_NAME when no argument is given", () => {
@@ -107,18 +100,18 @@ const rejectedCases: {
     expectedError: /CHANGELOG\.md has no "## \[1\.2\.3\]" entry/,
   },
   {
-    name: "rejects a prerelease that is not a release candidate",
-    args: ["node-v1.2.3-beta.1"],
-    packageJson: { ...RELEASABLE, version: "1.2.3-beta.1" },
-    changelog: "# Changelog\n\n## [1.2.3-beta.1] - 2026-01-01\n\n- Something.\n",
-    expectedError: /Only release versions .* and release candidates/,
+    name: "rejects a release candidate",
+    args: ["node-v1.2.3-rc.1"],
+    packageJson: { ...RELEASABLE, version: "1.2.3-rc.1" },
+    changelog: "# Changelog\n\n## [1.2.3-rc.1] - 2026-01-01\n\n- Something.\n",
+    expectedError: /1\.2\.3-rc\.1 is a prerelease/,
   },
   {
     name: "rejects a dev version",
     args: ["node-v0.1.0-dev.0"],
     packageJson: { ...RELEASABLE, version: "0.1.0-dev.0" },
     changelog: "# Changelog\n\n## [0.1.0-dev.0] - 2026-01-01\n\n- Something.\n",
-    expectedError: /prerelease suffix "-dev.0"/,
+    expectedError: /0\.1\.0-dev\.0 is a prerelease/,
   },
   {
     name: "rejects --require-npm without a value",
@@ -156,39 +149,6 @@ for (const testCase of rejectedCases) {
   });
 }
 
-const RC = { ...RELEASABLE, version: "1.2.3-rc.1" };
-const RC_CHANGELOG = "# Changelog\n\n## [1.2.3-rc.1] - 2026-01-01\n\n- Something.\n";
-
-test("publishes a release under the latest dist-tag", () => {
-  const result = runVerify(["node-v1.2.3"], RELEASABLE);
-
-  assert.equal(result.status, 0, result.stdout + result.stderr);
-  assert.match(result.stdout, /with dist-tag latest\./);
-});
-
-test("publishes a release candidate under the next dist-tag", () => {
-  const result = runVerify(["node-v1.2.3-rc.1"], RC, RC_CHANGELOG);
-
-  assert.equal(result.status, 0, result.stdout + result.stderr);
-  assert.match(result.stdout, /with dist-tag next\./);
-});
-
-test("writes the dist-tag to GITHUB_OUTPUT when set", () => {
-  const outputDirectory = mkdtempSync(join(tmpdir(), "elasticache-gh-output-"));
-  const outputFile = join(outputDirectory, "out");
-  try {
-    const result = runVerify(["node-v1.2.3-rc.1"], RC, RC_CHANGELOG, {
-      GITHUB_REF_NAME: "",
-      GITHUB_OUTPUT: outputFile,
-    });
-
-    assert.equal(result.status, 0, result.stdout + result.stderr);
-    assert.equal(readFileSync(outputFile, "utf8"), "dist_tag=next\n");
-  } finally {
-    rmSync(outputDirectory, { recursive: true, force: true });
-  }
-});
-
 test("accepts an npm at or above the required version", () => {
   const result = runVerify(["node-v1.2.3", "--require-npm", "1.0.0"], RELEASABLE);
 
diff --git a/scripts/python_dev.py b/scripts/python_dev.py
index e21c1c2..dda2ef5 100755
--- a/scripts/python_dev.py
+++ b/scripts/python_dev.py
@@ -36,8 +36,8 @@
 PACKAGE = "developer-toolkit-elasticache"
 IMPORT_NAME = "developer_toolkit_elasticache"
 DO_NOT_UPLOAD = "Private :: Do Not Upload"
-# Release versions (X.Y.Z) and release candidates (X.Y.ZrcN, PEP 440).
-_PUBLISHABLE_VERSION = re.compile(r"\d+\.\d+\.\d+(rc\d+)?")
+# Only release versions (X.Y.Z) are published; no prereleases.
+_RELEASE_VERSION = re.compile(r"\d+\.\d+\.\d+")
 
 
 _COMMANDS = {
@@ -152,10 +152,10 @@ def verify(args: argparse.Namespace) -> int:
             f"({pkg_version}). Bump the version and re-tag."
         )
         return 1
-    if not _PUBLISHABLE_VERSION.fullmatch(pkg_version):
+    if not _RELEASE_VERSION.fullmatch(pkg_version):
         print(
-            f"::error::Version {pkg_version} is not publishable. Only release versions "
-            "(X.Y.Z) and release candidates (X.Y.ZrcN) are published."
+            f"::error::Version {pkg_version} is a prerelease. Only release versions "
+            "(X.Y.Z) are published."
         )
         return 1
     if DO_NOT_UPLOAD in project.get("classifiers", []):
@@ -168,8 +168,7 @@ def verify(args: argparse.Namespace) -> int:
     if drift:
         print(f"::error::{drift}")
         return 1
-    kind = "release candidate" if "rc" in pkg_version else "release"
-    print(f"Publishing version {pkg_version} ({kind}).")
+    print(f"Publishing version {pkg_version}.")
     return 0