[Puppo]

Adds a manually dispatched release workflow with patch, minor, and major choices, enabling approval-gated npm trusted publishing through the shared Fastify workflow.

The release job grants id-token: write and contents: write and pins fastify/workflows/.github/workflows/reusable-release.yml to b1a11bce713bc857e52b2231fec3c89071ad3135. The shared workflow uses the release environment, commits/pushes the version bump, publishes with npm provenance, and creates the GitHub Release. This JavaScript package needs no release build step.

Part of the JS-8 rollout batch, following the pilot in fastify/fastify-accepts#231.

Validation

Local validation with Node.js 24.21.0 and npm 11.19.0:

• npm install --ignore-scripts --no-audit --no-fund passed.
• npm run lint passed.
• npm test passed.
• Actionlint 1.7.12 passed; dispatch choices, permissions, reusable-workflow inputs, pinned SHA, and inherited release environment verified.
• npm pack: verified runtime entry lib/index.js, declaration entry types/index.d.ts, and unchanged package version 0.1.0.

Admin setup before the first release

These settings are not changed by this PR and remain unverified:

• Configure the release environment with required reviewer team fastify/release and deployment access exclusively for branch main; check for extra branch/tag policies.
• Confirm branch protection/rulesets allow the shared workflow to push the version commit using GITHUB_TOKEN.
• Configure the npm GitHub Actions Trusted Publisher for @fastify/server: label manual-gha-release, organization fastify, repository server, workflow filename release.yml, environment release, Allow publish enabled.
• After review, setup, and merge, validate one real release: approval gate/reviewer notifications, package contents/provenance, version commit, tag, and GitHub Release. Use manual Discord notification if necessary.

No version bump, npm publication, release dispatch, or administrative settings/access changes were performed while preparing this draft.

Additional validation notes:

• npm test ran with per-process NODE_OPTIONS addition --dns-result-order=ipv4first, based on loopback DNS issues observed in JS-6; no code or workflow environment setting changed.
• Initial lint scanned local untracked TokenSave cache files and reported formatting errors there. npm run lint passed in a clean archive of the PR commit using the same installed dependencies. Cache files were preserved and are excluded from the PR and inspected tarball.

[Tony133]

@Eomm, can you merge this? I don't have permission to do it—the button is disabled 😅. I think the three repositories you mentioned in the internal discussion are missing; the rest seems fine. I'll run some tests over the next few days on the TypeScript repositories, etc. For now, everything looks good.

@Puppo, I’ve merged all the PRs you created to avoid conflicts, etc. Thanks for your help and contributions!